Show HN: Hash your work and store it in a bank transfer for priority statement | Hacker News Reader

Show HN: Hash your work and store it in a bank transfer for priority statement

rschoenm.github.io

39 pointssteren43 comments

Courts don't really give a damn about postmarked letters and other gimmicks for preserving priority.

If priority matters for you, it costs about $100 to file a provisional patent application and that's what you should do.

What actual (as opposed to 'theoretical') problem does this solve? I understand it solves the fictitious 'prior art' problem many technical people think exists, but which few or no people who actually do patent stuff I know consider to be a real issue. Then again I haven't done any actual research on whether it is an issue, I'm just wondering if anybody with a legal background was involved in this.

(disclaimer: I have a law degree but have never practiced and have only ever written a few papers on patent matters, none of which directly involved the issue at hand).

Am I the only one that doesn't think this idea is particularly new or interesting? My cryptography professor in undergrad talked about the idea of hashing your work and publishing the hash in the classifieds of a newspaper as a publicly verifiable way to timestamp it. That was like 10 years ago and I don't think the idea was new at the time.

We don't pretend the idea is new (although Ralf did not find prior scientific works talking about this). We just want it to spread since it is simple and cheap.

Ralf did not check the classifieds.

A quick Google shows there is a good deal of prior published work on the idea of time stamping with hashes. The Wikipedia articles on the topic lists published references as early as 1991 and notes that the general idea itself dates to 1660 when Robert Hooke of Hooke's law fame published an anagram in a newspaper to timestamp his discovery.

http://en.wikipedia.org/wiki/Linked_timestamping

http://en.wikipedia.org/wiki/Trusted_timestamping#History

On another note, is using a bank transaction as a means of publishing even a good idea? The banks I use only keep recent transactions available online, between 6 months to two years. So, you would have to print out your bank statement save it and present that as the proof which isn't particularly convincing. With a newspaper anyone can go find a copy of that newspaper at a library and independently verify it. They won't be able to get your private bank records w/o a lot of hassle.

Do you also store the original document? From a quick overview it seems you only store the hash. A typical situation that might occur is that a client hashes his document, a couple of years later he want to proof priority but doesn't have the original document anymore (perhaps he appended it, fixed spelling errors etc). Now his priority statement is worthless.

Why not provide a facility for the client to store his document along with the hash, encrypted off course. He can encrypt the document himself or you can provide an application that does it for him.

Charge extra for this feature...

If you were going to hash your document and store the hash in a bank transfer comment field, then it would be in your interest to make sure you don't modify the document in any way.

It seems the online tool does nothing other than compute the SHA-1 hash. Given that it seems the documents that a user would want to hash for this method are likely to be sensitive, it seems prudent to suggest that users use an offline method of generating the hash.

Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You can read its sources to be sure about this.

That would require every user to validate the sources themselves.

See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)

We should dynamically compute a hash of the source files client-side and compare it with a previous hash validated by a trusted third party and available online. If they don't match, the client displays a red warning :)

I don't understand this point. In any case, the point is that we may trust your site today, but it may be compromised in the future. In which case it also can't be trusted to show any sort of warning.

Good idea in theory but it doesn't really work. If someone (like you) can change the code that the client gets then they can simply remove or fake the hash checking code.

Sure, a firefox extension could do that.

Here's my exploration of asm.js and the file API for making a offline SHA256:

https://rawgithub.com/kristofferkoch/web-lafs/master/test/sh...

Thanks. I am using https://code.google.com/p/crypto-js/#SHA-2 but no web workers yet, this can be a problem with large files.

Why not just push your work to a private GitHub repo? That would establish priority and ownership in a much clearer way than inserting a hash into a bank transfer.

I really think hashing the work causes more problems than it solves.

You can fake the dates on git commits. This repo has commits dating back 20 years: https://github.com/Gawen/life/commits/master?page=3

Hi, Ralf and I would love to hear the feedback of HN about the idea of using bank transfers to store a hash of a document and use this for priority statement (to prove that you had the document at a certain date). Our goal is to spread the free idea since we do not think it is used a lot. We created web and windows software to help people computing a sha256 of their document. Any feedback is welcomed. Thanks

Do you want others to implement your idea as well?

Our main goal is to help spread the word and see others using this technique. Implementation is not so difficult since only a hash, but if you want to contribute or implement it, sure.

Wouldn't the blockchain be a better place to be sending people to do things like this?

I think one of the advantages of using a bank transfer is that it's more easily understandable by the general population.

Well, you'd have to explain a hash function anyways, so you can also go ahead and explain the blockchain ;)

Sure, but I suspect people would also have some inherent trust in bank transfers as opposed to the block chain, which they may not fully understand.

Hi, This was also the feedback we had from /r/crypto on Reddit. You are right, the blockchain would be completely fine and could be even more automated. But we think that bank statement are more familiar to judges. Banks have to duty to keep the statements and be able to issue an official copy when requested for a few decades.

Would wager that a copy of the Bitcoin blockchain outlives many banks.

http://www.proofofexistence.com/about -- blockchain version.

Do banks have to maintain the "Comments" by law?

Cuter, yes, but probably not measurably better from a security perspective, unless your threat model includes adversaries who can change the internal records of two separate banks.

The advantage of using bank transfers is it is much easier to explain to a judge/jury.

Bitcoin is public and automatable, so it could be better for some applications where courts aren't involved -- but where would you need to categorically prove priority but not have a court at least potentially involved?

> The advantage of using bank transfers is it is much easier to explain to a judge/jury.

This seems like a really weak argument.. There are all types of things judges don't understand outright but can be made to be understood. The chance of a priority being granted to a hash embedded to a bank transfer and not a block-chain embedded one is essentially zero (all things being equal). Since it is both cheaper and more robust, a super-secure blockchain like bitcoin is clearly superior to a bank transfer.

Does the blockchain have a notion of time as in dates? I believe it only notes continuity from one block to the next.

You could probably get the same effect by just sending an e-mail using Gmail (or equivalent online service that wont let you modify its internals) though?

Seems much simpler, and you don't have to explain hashes to anyone....

Sure, the idea is here. But I am not sure if Google can be a trusted party regarding timestamps of emails in court.

This sounds like a case of crypto nerd's fantasy: http://xkcd.com/538/

In theory...

Judge: "The SHA1 hash in the bank transfer dated 1 Jan matches the hash I calculated for the document you supplied me, so you must have had access to the document on 1 Jan. I believe you"

In reality...

Judge: "Wait, you sent an e-mail with this document on 1 January?" You: "Sure, here's my gmail account. See this screenshot" Judge: "Well, that sorts it"

Related: Bitcoinproof

Create a forgery-proof timestamp for your data, secured by the bitcoin network.

http://vog.github.io/bitcoinproof/

And: http://www.proofofexistence.com/

/r/crypto also suggested http://www.cryptostamp.net/

Is this any better than using pastebin? One may argue that banks are more trusted for storing money than pastebin is for data, but is there another reason?

As you can read in the translation of the original article[0], the difference here is that banks must archive data about bank transfers for at least 10 years (in Germany), and are obliged to hand out this information on request. PasteBin does not guarantee this and may also not allow you to store a private document.

0: http://rschoenm.github.io/prioprepare/article.html

I assume that the rationale is as follows.

When standing in court trying to prove that you wrote something at a point in time, the judge is more than likely going to accept a bank statement than pastebin.com.

... or put it somewhere publicly accessible/verifiable.

For example a crypto currency block-chain.

Reply on news.ycombinator.com