8 ms·
QR Date – signed timestamps inside for verifying dates
- jka 5y agoA practical idea. I wonder whether a more consensus-based alternative to this could use some aspects of the current-highest-block from a blockchain to incorporate proof of a previously-unknowable, globally-verifiable value.
- gsich 5y agoNo matter what you use, you can backdate everything.
- 00117 5y agoWhy is this true?
- gsich 5y agoYou record a event today and use the hash from last week.
- jka 5y agoUnless you're hoarding some material that emits a verifiable, secure random information into the future while itself being depleted in the process?
- StevenWaterman 5y agoThe typical solution to this is to create the message, publish its hash immediately, then publish the message itself at a later date.
- miunau 5y agoSome sort of a web of trust based on fingerprinting has been discussed, but it's an abstract idea still. Currently I don't think a blockchain would bring any added advantage- in my mind there is no need for unobserved codes that are older than a few hours unless someone emerges from a jungle or similar place with zero internet coverage to distribute the photography. The whole idea is that outside observation needs to happen rapidly for social proof to emerge, based on which journalistic organisations could make editorial decisions.
- msoad 5y agoI agree that you don't need a blockchain for this but consensus systems can be nice. A system that others can run this system and somehow verify with your keys as well as their own, or anyone running this and offering the API. So scanning that QR code will send me to the website of whoever generated it but will also show other instances's approval there.
- miunau 5y agoYes, it's a good idea. It has some security and privacy considerations of its own which are outside of my area of expertise, and I believe it could be implemented on top of the existing spec.
- amelius 5y agoAnd this could make it more useful too. You could prove that an event happened before a certain timepoint (not after it). Some notary services allow you to inject documents or hashes into cryptocurrency blockchains which prove that the submitted documents existed before a timepoint.
- lucb1e 5y ago> You could prove that an event happened before a certain timepoint (not after it). Not with what GP proposes. If I understand their proposal correctly, it is to include a value from "the current-highest-block from a blockchain to incorporate proof of a previously-unknowable, globally-verifiable value." You can always include historic values trivially. It is much more involved to actually do a transaction on that chain, which could indeed be used to prove existence before a certain time. But yes, your alternative proposal would work for that, if you assume the chain cannot be controlled by any individual/partisan party.
- edent 5y agoI don't get the problem this solves. As it says, I can use a code from today and add it to a video from yesterday. I don't know who controls the private key, so how can I trust that they won't sign tomorrow's timestamp today? If someone scans the code, and visits the website, their IP and UA will be logged. Which is a good way to track who has viewed your video.
- miunau 5y agoHi, These are all valid concerns. Programatically superimposed usage of the code is problematic for all the same problems as with EXIF manipulation, so the thinking is to recommend using a physical prop (smartphone or paper) that makes it harder to fake the code in later. When combined with rapid distribution (to a news agency, live feed, Telegram or such), there's a period of time where I think it's unfeasible that someone would had tampered with it to future-date an older image. It is possible to superimpose the code of course, as I noted: "For example, when uploading photos through a messenger service, the service can sign the photos upon upload date and superimpose the QR Date onto it. Any further uploads to date the photo again would have to either crop the code out or otherwise mangle it so much that it would raise suspicion. For videos, the QR Date can be superimposed as either moving around in the frame, switch places, or other motion to make it harder to superimpose another code later." However these would only be indicative, not definite proof, and would need to be combined with other efforts- mainly deduplication, to find doubles. For key storage and logging, I don't think it's my job to try to convince people to trust me with a private key (or logs) for the purposes of introducing this idea. Frankly I do not want the responsibility. If it ends up being useful, I would be happy to donate the domain to a reputable NGO or journalistic organisation for proper storage of the private key on a hardware device, contracts on how it and logs are handled, etc. In the meanwhile, if you want to trust the site, it's up to you just like with any CA. I don't think a single online centralised authority would be a good idea in any case- it's why I'm trying to also consider situations where it can be used offline and by many organisations that each have their own requirements for trust.
- megapatch 5y agoIt is a modern version of displaying the current first page of a newspaper to prove something has not happened earlier than the displayed reference.
- amelius 5y agoThat's probably why QRDate has a news headline in the footer of the opening screen.
- IYasha 5y agoYup, I'd love the old way better. As long as it's human-readable. I hate barcodes in a way because they require tools to read. And circumstances vary a lot!
- crtasm 5y agoI like what the Qubes developers have done with a short script adding current headlines and bitcoin block hash to their warrant canaries: https://github.com/QubesOS/qubes-secpack/blob/master/canaries/canary-029-2021.txt#L86-L113 https://github.com/QubesOS/qubes-secpack/blob/master/canarie... edit: and the script itself: https://github.com/QubesOS/qubes-secpack/blob/master/utils/proof_of_freshness.py https://github.com/QubesOS/qubes-secpack/blob/master/utils/p...
- fbn79 5y agoYou could create a QR based on the last block of BITCOIN blockchain. These way you do not rely on a private key and onyone can check and trust it.
- can16358p 5y agoRemimds me of Vitalik Buterin holding a paper with a new block's hash and posting his photo when there were rumors about him being dead a few years ago.
- deleted 5y ago[deleted]
- thamer 5y agoI hadn't heard of this, this is a pretty cool way to provide this proof. Back story: https://www.coindesk.com/markets/2017/06/26/proof-of-life-vitalik-buterin-uses-ethereum-to-disprove-death-hoax/ https://www.coindesk.com/markets/2017/06/26/proof-of-life-vi... The block in question (open "Click to see more" and look for the "Hash" field): https://etherscan.io/block/3930000 https://etherscan.io/block/3930000
- avnigo 5y agoThat reminds me something like the OpenTimestamps project: https://opentimestamps.org/ https://opentimestamps.org/
- amelius 5y agoHave these stamps already been tested in a court of law?
- rosndo 5y agoThis question doesn’t make any sense, there’s nothing to “test”. An irrefutable cryptographic timestamp is just that, irrefutable. Sometimes courts make mistakes, but you can’t expect any useful precedent over something like this.
- systemz 5y agoFrom UX side, nice addition would be displaying time in local time zone from browser and/or additional list to select timezone/country on page with scanned QR code
- miunau 5y agoThanks for the feedback, on the front page it was a consideration to keep it UTC to not accidentally dox anyone using it on-stream. I like the idea for having a selectable timezone on the verification page.
- kmfrk 5y agoVery clever! The news article headlines get cut off pretty quickly to the effect of "Putin [says something]", but I guess it's not overly important as long as the headlines differ in wording.
- miunau 5y agoThanks! I thought about using <marquee> for some flair, but concluded it's best to leave it as simple as possible for now. :) The headline is there to try to provide some familiarity to the idea and it's not required for implementation.
- kmfrk 5y agoYeah, a marquee probably introduces the potential for blur, which can obscure the photo/video and also create false positive suspicions of manipulation if it looks blurry in the finished capture.
- jwilk 5y agoThe date is off by 2000 years.
- kazinator 5y ago> but if you include a timestamp that was signed by a trusted third party within your photo, in a reasonably non-fakeable way, it is then provable beyond a reasonable doubt that you indeed are capturing the near-present. This smells like complete bullshit to me. You can incorporate a QR code like this into any image whatsoever. To prove "beyond a reasonable doubt" that an image was taken at a certain date, or not before a certain date, you need a trusted witness who saw it being taken, who signs the entire image.
- miunau 5y agoYes, the observer (preferably multiple) is an integral part of the process. The second signing is an interesting idea, though I'm not sure if it would prove more veracity over, say, a newsroom verifying the code.
- kazinator 5y ago"verifying the code" means absolutely nothing. Any code you're verifying is from the past, and could be edited into any image from any time in the past. All you know is that neither the image nor the code came from the future, which is self-evident. I suspect the idea here is to rely on it being difficult to forge a printed version of the QR code that is shot together with the scene. For that purpose, a newspaper is better; it is more complex. I mean, someone could take a picture in, say, the year 2032, using a new QR code (printed on paper and everything), and then carefully edit an old QR 2022 QR code into that image. It's a very regular, high contrast, simple image. In the era of deep fakes, I can't believe someone would think any of this is "beyond the shadow of a doubt".
- miunau 5y agoA newspaper might not be available; often pictures with a blank piece of paper with the date written are used. QR Date relies on the signature in the QR code, not just the date, which makes it harder to fake within a reasonable amount of time. The proof is based on the public key being from a trusted authority, and the speed of dissemination. I don't think anyone has said "beyond the shadow of a doubt" besides you. Reasonable doubt is a different thing. If you wanted more veracity, you could always keep on taking more pictures around the subject with more codes, or just keep holding the generator within frame for video.
- Szpadel 5y agoIMO more useful would be signing while image with verifiable timestamp. this could be used then to prove that some image is at least that old. It could be useful when you expect that someone will try to alter it and publish it as original, you could then prove that your version is older therefore have to be original.
- tylergetsay 5y agoThis is similiar to how Smart Health Codes (COVID-19 QR Code) work, they contain JWTs which link to the public key. You keep a list of valid public URLs to trust.
- jaypinho 5y agoThis might be a weird analogy but this product feels like it recreates the NFT problem -- meaning that it's inherently self-referential and doesn't actually solve the problem it purports to. NFTs are supposed to be an irrefutable, immutable record of ownership. But the only thing they can actually "prove" is the ownership of the NFT itself. It's like having a receipt that says "I own this receipt." It's a similar story here: using a QR code is proof that at one point you got this QR code from qrdate.org, but it doesn't prove you didn't manipulate the image or video, in which case what value is it providing?