6 ms·

Show HN: CryptoProof – post proofs to the Ethereum blockchain for free

55 points by flixic 8y ago

flixic 8y ago
Hi HN. Quick comments about this project: * Today is 10 year anniversary to the original bitcoin.pdf release. This pdf is the first document proof I posted, included in the first release: https://cryptoproof.org/release/2018-10-30-09 https://cryptoproof.org/release/2018-10-30-09 * I’ve recently left a startup and will try to build a bunch of smaller ideas rather quickly and see if any of them resonate. This one took about 10 days to build, and it’s my first “static Vue.js frontend + a separate backend” project. * This is not a very advanced project. It simply collects posted hashes, hashes them together to create a “Release”, and posts that one combined hash to the Ethereum blockchain. I have some useful ideas for the future, but until then it’s just a free and (hopefully) a user-friendly way to post timestamped proofs. * Having a separate API backend means I can offer a developer API quite easily. For now it doesn’t require any authentication, and that probably means it might get DDoSed quickly. Please don’t abuse it. I am interested in building a useful service, so if you have any ideas, let me know! If you have any feedback, please let me know!
- desdiv 8y ago
  How do you compare to opentimestamps.org? (other than ETH instead of BTC)
  - flixic 8y ago
    For now, it's very similar. The main difference is that OpenTimestamps is a bit more opaque. Basically, you get a confirmation, and then you can validate stuff on the site. I try to provide full instructions how to verify everything without CryptoProof site at all, just tracing the transaction.
    - Kinnard 8y ago
      How is it more opaque?
      - flixic 8y ago
        When submitting, you get a binary .ots file, and no idea how exactly the file is submitted to the blockchain. The only way to verify is to re-upload the .ots file and get the yes or no response. Actually tracking the chain of proof is very difficult. Compare: https://opentimestamps.org/info/?004f70656e54696d657374616d7073000050726f6f6600bf89e2e884e8929401086606799577adf2fbf11f19e08541261f668717bda6158d13847f15694f5aef5af010a5544f0343834e76b2142ac4234f308908fff010dbfa6027a160ed914221b7950db8994608f1045bd866b1f008bcf8cc2c8b24178d0083dfe30d2ef90c8e2e2d68747470733a2f2f616c6963652e6274632e63616c656e6461722e6f70656e74696d657374616d70732e6f7267fff01060d4412b9e44310e2f6eef117c0f8ab908f1045bd866b1f008d63cb707a49ebd140083dfe30d2ef90c8e2c2b68747470733a2f2f626f622e6274632e63616c656e6461722e6f70656e74696d657374616d70732e6f7267f010766c68d9ead6def9e237d89520565fbd08f0104f3aa30ed21ef48f03ba052d649ffbd508f1045bd866b1f00849ca29f548d095f50083dfe30d2ef90c8e292868747470733a2f2f66696e6e65792e63616c656e6461722e657465726e69747977616c6c2e636f6d https://opentimestamps.org/info/?004f70656e54696d657374616d7... vs https://cryptoproof.org/release/2018-10-30-09 https://cryptoproof.org/release/2018-10-30-09
- decentralised 8y ago
  Have you considered using merkle proofs? This way the data you will submit on-chain will be relatively small and stable and you can provide the proofs directly on the front-end / client side.
  - flixic 8y ago
    Merkle proofs sound like a more appropriate tool for the job, but I don't know enough about it. Do you have any tips what to read about for this?
    - decentralised 8y ago
      Sorry for the delay but I'm at Devcon :-) Perhaps the easiest way to get started is with this npm package: https://github.com/ameensol/merkle-tree-solidity https://github.com/ameensol/merkle-tree-solidity If you want to learn more about the theory behind merkle trees and its variants, let me know.
      - flixic 8y ago
        Please send my regards to Mr Buterin. Your profile does not contain any contact information. Is there a channel you prefer to be contacted via if I have some further ideas or questions?
        decentralised 8y ago
        telegram: @decentralised
    - tromp 8y ago
      Also of interest are Mountain Merkle Ranges as explained here for instance: https://github.com/mimblewimble/grin/blob/master/doc/mmr.md https://github.com/mimblewimble/grin/blob/master/doc/mmr.md These are append-only trees with height only logarithmic in number of appends.
- asasidh 8y ago
  when you say "hash them together" do you mean concatenate or use a merkle tree ? Merkle tree has the added advantage of being able to prove that a certain hash was part of the root with by a tree traversal.
  - flixic 8y ago
    Currently just concatenate but I will switch to Merkle trees.
pentaxy 8y ago
Quick glance: there doesn't appear to be a way to link to specific messages for verification - I understand it will be difficult for large files, etc. but you can probably squeeze a base64-encoded value in the URL #hash for short messages. Also HN, are there any other existing services for proofs?
- flixic 8y ago
  When you submit a message, I locally generate a file you can download (or copy to clipboard), that contains the message, hash and the release it will go to. For text messages, I could also generate a special link. Good idea! Edit: to follow up on your other question, I found a bunch of other services like that. Most of them are paid per proof, though. https://stampd.io https://stampd.io https://proofofexistence.com https://proofofexistence.com https://blocksign.com https://blocksign.com https://www.blocknotary.com https://www.blocknotary.com https://opentimestamps.org https://opentimestamps.org (Free) https://notary.bitcoin.com https://notary.bitcoin.com
- dangero 8y ago
  Chainpoint.org
  - flixic 8y ago
    Oh, this is interesting. Somehow I haven't found it in my research.
arendtio 8y ago
> Geeky summary: we hash content client-side, collect all the hashes posted in an hour, hash them together and post their combined hash as input in the transaction on the Ethereum blockchain, establishing the chain of proof. Didn't know that my Greek was so much better than my English ;-)
deleted 8y ago
[deleted]
baotrungtn 8y ago
You need gas to post your "Release" to Ethereum blockchain and gas costs money. How is it possible to be free?
- crazydoggers 8y ago
  I’m guessing they are subsidizing it. On the how it works page it says “Any message, regardless of its original size, only generates a 32 byte content hash and costs about $0.03 to submit to the blockchain.” Also “CrypoProof is free to use because instead of sending each content hash as a separate transaction, CryptoProof combines all the hashes posted during the same hour into a Release. The release simply contains all the content hashes posted that hour.”
- flixic 8y ago
  It costs about 0.8 ETH per year to run, and I’ve personally funded it with 1 ETH. I do appreciate donations: https://cryptoproof.org/support https://cryptoproof.org/support
21stio 8y ago
dope
wfn 8y ago
What a nice useful easy-to-use service, thanks for this, Jonai :) A comment (relevant to this site but also a more general ramble towards the direction of "why don't sites which use production-important JS try this more often"): given that the default non-API use case involves users running client-side JS, I wonder if you've considered pinning your "must send only the hash to the server" script code via CSP / script-src: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... (When JS scripts are "stable" enough, compute their hashes and include those hashes in the source via script-src (a sort of "certificate pinning" thing). I know it's not supported everywhere yet etc etc, I haven't paid close attention re: this but maybe that's the reason as to its limited adoption thus far?..) Anyway, very smooth and I love the "can prove if service is gone" and "no stupid ICO" parts, obviously.
- flixic 8y ago
  Thanks for the comment, Kostai! The entire frontend is a static Vue.js thing built with Vue CLI that uses Webpack behind the scenes. It seems I should be able to automatically add CSP via a webpack plugin. Noted.
davidcollantes 8y ago
Are you planning on open sourcing this? Thanks!
- flixic 8y ago
  Maybe, but unlikely. I have some future ideas that might become a premium service. Also, I'm not sure what the OSS community would gain from this being open sourced. The "algorithm" is just "hash a bunch of hashes". The rest is just a neat frontend and a really simple backend.
nnn1234 8y ago
Very nice.. excellent job on making the copy easy to understand. Would love to link to this project in my ongoing collection of cool blockchain stuff. Enjoy Devcon.. Also let me know what I can do about those small ideas that you want to implement.Have a couple myself!

55 points by flixic 8y ago

Hi HN. Quick comments about this project: * Today is 10 year anniversary to the original bitcoin.pdf release. This pdf is the first document proof I posted, included in the first release: https://cryptoproof.org/release/2018-10-30-09 https://cryptoproof.org/release/2018-10-30-09 * I’ve recently left a startup and will try to build a bunch of smaller ideas rather quickly and see if any of them resonate. This one took about 10 days to build, and it’s my first “static Vue.js frontend + a separate backend” project. * This is not a very advanced project. It simply collects posted hashes, hashes them together to create a “Release”, and posts that one combined hash to the Ethereum blockchain. I have some useful ideas for the future, but until then it’s just a free and (hopefully) a user-friendly way to post timestamped proofs. * Having a separate API backend means I can offer a developer API quite easily. For now it doesn’t require any authentication, and that probably means it might get DDoSed quickly. Please don’t abuse it. I am interested in building a useful service, so if you have any ideas, let me know! If you have any feedback, please let me know!

desdiv 8y ago
How do you compare to opentimestamps.org? (other than ETH instead of BTC)
- flixic 8y ago
  For now, it's very similar. The main difference is that OpenTimestamps is a bit more opaque. Basically, you get a confirmation, and then you can validate stuff on the site. I try to provide full instructions how to verify everything without CryptoProof site at all, just tracing the transaction.
  - Kinnard 8y ago
    How is it more opaque?
    - flixic 8y ago
      When submitting, you get a binary .ots file, and no idea how exactly the file is submitted to the blockchain. The only way to verify is to re-upload the .ots file and get the yes or no response. Actually tracking the chain of proof is very difficult. Compare: https://opentimestamps.org/info/?004f70656e54696d657374616d7073000050726f6f6600bf89e2e884e8929401086606799577adf2fbf11f19e08541261f668717bda6158d13847f15694f5aef5af010a5544f0343834e76b2142ac4234f308908fff010dbfa6027a160ed914221b7950db8994608f1045bd866b1f008bcf8cc2c8b24178d0083dfe30d2ef90c8e2e2d68747470733a2f2f616c6963652e6274632e63616c656e6461722e6f70656e74696d657374616d70732e6f7267fff01060d4412b9e44310e2f6eef117c0f8ab908f1045bd866b1f008d63cb707a49ebd140083dfe30d2ef90c8e2c2b68747470733a2f2f626f622e6274632e63616c656e6461722e6f70656e74696d657374616d70732e6f7267f010766c68d9ead6def9e237d89520565fbd08f0104f3aa30ed21ef48f03ba052d649ffbd508f1045bd866b1f00849ca29f548d095f50083dfe30d2ef90c8e292868747470733a2f2f66696e6e65792e63616c656e6461722e657465726e69747977616c6c2e636f6d https://opentimestamps.org/info/?004f70656e54696d657374616d7... vs https://cryptoproof.org/release/2018-10-30-09 https://cryptoproof.org/release/2018-10-30-09
decentralised 8y ago
Have you considered using merkle proofs? This way the data you will submit on-chain will be relatively small and stable and you can provide the proofs directly on the front-end / client side.
- flixic 8y ago
  Merkle proofs sound like a more appropriate tool for the job, but I don't know enough about it. Do you have any tips what to read about for this?
  - decentralised 8y ago
    Sorry for the delay but I'm at Devcon :-) Perhaps the easiest way to get started is with this npm package: https://github.com/ameensol/merkle-tree-solidity https://github.com/ameensol/merkle-tree-solidity If you want to learn more about the theory behind merkle trees and its variants, let me know.
    - flixic 8y ago
      Please send my regards to Mr Buterin. Your profile does not contain any contact information. Is there a channel you prefer to be contacted via if I have some further ideas or questions?
      - decentralised 8y ago
        telegram: @decentralised
  - tromp 8y ago
    Also of interest are Mountain Merkle Ranges as explained here for instance: https://github.com/mimblewimble/grin/blob/master/doc/mmr.md https://github.com/mimblewimble/grin/blob/master/doc/mmr.md These are append-only trees with height only logarithmic in number of appends.
asasidh 8y ago
when you say "hash them together" do you mean concatenate or use a merkle tree ? Merkle tree has the added advantage of being able to prove that a certain hash was part of the root with by a tree traversal.
- flixic 8y ago
  Currently just concatenate but I will switch to Merkle trees.

pentaxy 8y ago

Quick glance: there doesn't appear to be a way to link to specific messages for verification - I understand it will be difficult for large files, etc. but you can probably squeeze a base64-encoded value in the URL #hash for short messages. Also HN, are there any other existing services for proofs?

flixic 8y ago
When you submit a message, I locally generate a file you can download (or copy to clipboard), that contains the message, hash and the release it will go to. For text messages, I could also generate a special link. Good idea! Edit: to follow up on your other question, I found a bunch of other services like that. Most of them are paid per proof, though. https://stampd.io https://stampd.io https://proofofexistence.com https://proofofexistence.com https://blocksign.com https://blocksign.com https://www.blocknotary.com https://www.blocknotary.com https://opentimestamps.org https://opentimestamps.org (Free) https://notary.bitcoin.com https://notary.bitcoin.com
dangero 8y ago
Chainpoint.org
- flixic 8y ago
  Oh, this is interesting. Somehow I haven't found it in my research.

arendtio 8y ago

> Geeky summary: we hash content client-side, collect all the hashes posted in an hour, hash them together and post their combined hash as input in the transaction on the Ethereum blockchain, establishing the chain of proof. Didn't know that my Greek was so much better than my English ;-)

deleted 8y ago

[deleted]

baotrungtn 8y ago

You need gas to post your "Release" to Ethereum blockchain and gas costs money. How is it possible to be free?

crazydoggers 8y ago
I’m guessing they are subsidizing it. On the how it works page it says “Any message, regardless of its original size, only generates a 32 byte content hash and costs about $0.03 to submit to the blockchain.” Also “CrypoProof is free to use because instead of sending each content hash as a separate transaction, CryptoProof combines all the hashes posted during the same hour into a Release. The release simply contains all the content hashes posted that hour.”
flixic 8y ago
It costs about 0.8 ETH per year to run, and I’ve personally funded it with 1 ETH. I do appreciate donations: https://cryptoproof.org/support https://cryptoproof.org/support

21stio 8y ago

dope

wfn 8y ago

What a nice useful easy-to-use service, thanks for this, Jonai :) A comment (relevant to this site but also a more general ramble towards the direction of "why don't sites which use production-important JS try this more often"): given that the default non-API use case involves users running client-side JS, I wonder if you've considered pinning your "must send only the hash to the server" script code via CSP / script-src: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... (When JS scripts are "stable" enough, compute their hashes and include those hashes in the source via script-src (a sort of "certificate pinning" thing). I know it's not supported everywhere yet etc etc, I haven't paid close attention re: this but maybe that's the reason as to its limited adoption thus far?..) Anyway, very smooth and I love the "can prove if service is gone" and "no stupid ICO" parts, obviously.

flixic 8y ago
Thanks for the comment, Kostai! The entire frontend is a static Vue.js thing built with Vue CLI that uses Webpack behind the scenes. It seems I should be able to automatically add CSP via a webpack plugin. Noted.

davidcollantes 8y ago

Are you planning on open sourcing this? Thanks!

flixic 8y ago
Maybe, but unlikely. I have some future ideas that might become a premium service. Also, I'm not sure what the OSS community would gain from this being open sourced. The "algorithm" is just "hash a bunch of hashes". The rest is just a neat frontend and a really simple backend.

nnn1234 8y ago

Very nice.. excellent job on making the copy easy to understand. Would love to link to this project in my ongoing collection of cool blockchain stuff. Enjoy Devcon.. Also let me know what I can do about those small ideas that you want to implement.Have a couple myself!