Hacker News Reader

Comment by recursive | Hacker News Reader

Here's my plan.

1. Cryptographically hash each piece of media when it's recorded.

2. Submit the hash to a "trusted" authority.

3. It will add a timestamp and sign the result.

4. Now, as long as you keep the original, without re-compressing, and you trust the authority, you have some evidence that the media existed at a timestamp. On or before.

This doesn't prove authenticity, but in many cases, establishing a timestamp would be enough. Forgeries probably wouldn't be created until later, after the shit hit the fan.

Or maybe this doesn't work at all.

View on HN

Thieves are planning an inside job. They forge the surveillance video ahead of time, do the theft and submit the forgery to be timestamped while it's happening.

Also, a lot of surveillance systems are purposely kept offline to prevent them from being compromised, but your system doesn't allow that because they would need external connectivity to get signatures.

Sure when you're controlling the source, you can fake it. But requiring the fakes be prepared ahead of time locks the faker into one story that may be contradicted by other evidence.

That's pretty much what happens anyway. The police are going to come collect the footage as soon as the crime is reported and you can't change it after they do.

This technique is known as an Ella Fitzgerald to those in the heisting industry, as popularized in the documentary Oceans 11.

Oceans 11 is a work of fiction because most people don't have that skillset and the ones who do can make a lot of money doing honest work without risking a long prison sentence, so they're not tempted to rob casinos to heisting music.

The issue here is that the skillset required to produce the forgery has fallen to the level that anybody can do it and then that's enough people that somebody actually does.

You can do this already by yourself or use a service which you need not even trust.

Every x seconds, collect all the pieces of data that need to be notarized as existing in the world prior to some time t. It can be an arbitrary amount of data.

Construct a Merkle Tree[1] of all the hashes (or HMACs) of all the data to be notarized. Compute the Merkle Root. Make sure that everyone gets their Merkle Proof (path from leaf to root) or publish the Merkle Tree publicly.

Embed the Merkle Root into a one or more cryptocurrency blockchains to exploit their immutability guarantees. By either including it as "additional data" to some transaction or just straight up as a fictional cryptocurrency address.

Every piece of data processed in this way will have a Merkle Proof (cryptographic path from hash of the data to the Merkle Root) that proves it existed prior to the creation of the Merkle Root. The Merkle Root will have its creation time bounded by the proof of work conducted on the cryptocurrency blockchain.

[1] <https://en.wikipedia.org/wiki/Merkle_tree>

There are some tradeoffs here. You need to do currency transfers get a timestamp, with all the constraints that comes with. But you get probably a more trustworthy authority.

Isn't this basically achieved by standard cloud storage on phones? Photos and videos get uploaded automatically (with authentication for the user account) and presumably that action is logged somewhere the user can't edit. Just need to prove those logs are secure, and there you go.

Unless you’re they police in a murder case, you’re probably not going to get google or apple to give you something that certifies that a file was uploaded before a specific time and not modified after. And just showing me the modification date in the UI wouldn’t convince me.

Much easier with the account holder's consent, it's probably in the "data download" thing you can request. And probably available by subpoena. It's like phone records.

I don't mean "date modified" in the file metadata when it's uploaded (of course that could easily be spoofed before upload) but the actual "date uploaded". You know something must have been made before a certain time.

Reply on news.ycombinator.com