Hacker News Reader

I can't figure out why you would approach the problem this way. If you want arbitrary HTTPS connections to be verifiable and provable, why not just propose an edition to the spec which does this? This seems easier than the proposed solution, which is to introduce a trustworthy middle man to all of your online purchases. It also seems to imply the request query path is public data when this is encrypted under HTTPS afaik.

View on HN

If you want to do something today not in ten years you use the existing protocols.

Because with this approach, the entity making the statement doesn't have to cooperate. Even if they want to cooperate, there's a lot of chicken-and-egg problems in trust infrastructure that you sidestep by leveraging the existing Web TLS PKI. It would quite powerfully allow you to notarize and audit any statement by any domain.

Unfortunately (some would say fortunately) this isn't cleanly possible, so you still have to rely on witnesses and/or magic ledgers in the sky for trust.

Reply on news.ycombinator.com