5 ms·

I wonder why we don't have better (widely trusted and used) timestamping services. It has always been easy to prove that something happened after a certain time

I wonder why we don't have better (widely trusted and used) timestamping services. It has always been easy to prove that something happened after a certain time: take a photo of today's newspaper, mention stock prices, etc. But proving that an event happened before a certain time, like in the article, is a lot harder. You can send someone an email through a trusted gateway, but people can only check by having access to that mailbox, or trusting the person who has access. And I know about PKI timestamping, but I've never seen them used for legal cases, maybe because the complexity erodes trust. Are there any good solutions that would convince a non-technical judge? Edit: I remember Twitter[1] being used for this purpose, but I don't know if today I'd trust a hash dropped there, given how much it's evolving and/or struggling. [1] https://news.ycombinator.com/item?id=26609183 https://news.ycombinator.com/item?id=26609183

mananaysiempre 3y ago
Don’t know how convincing it’d be in court, but Open Timestamps[1], a free service that operates by publishing Merkle tree hashes to the Bitcoin ledger and can give you independently-verifiable proofs after a while, still exists even if it doesn’t seem to be under active development. (I think Keybase tried something like that some time ago as well, they already had most of the parts in place, but then they decided to use their own something-or-other-coin and I stopped paying attention.) [1] https://opentimestamps.org/ https://opentimestamps.org/
- vintermann 3y ago
  A good example of using bitcoin for something that was entirely possible with regular old public key cryptography. Matthew Richardson's Stamper has been running since 1995.
  - rstuart4133 3y ago
    > Matthew Richardson's Stamper That was hard to find. My first google searches turn up this post. Here it is, in case anyone is interested: https://www.itconsult.co.uk/stamper/stampinf.htm https://www.itconsult.co.uk/stamper/stampinf.htm In the end both are just digital signatures, and so are "entirely possible with regular old public key cryptography" as you say. You can achieve a similar effect by sending a gmail message to yourself with an sha256 of the document in the subject. The subject and date are included in the gmail DKIM signature. The cryptographic primitives used by Stamper, gmail DKIM and bitcoin are equally secure as a first approximation. That means the security ultimately rests on the security of the key used to sign it. So do you trust Matthew Richardson to keep is gpg key secure, or Google to keep their DKIM secure, or the difficulty imposed by a proof of work where the amount of work is equal to a nation states electricity supply? I know which I'd choose out of those three, and that's the key differentiator of bitcoin. It is not the cryptographic primitives used.
    - vintermann 3y ago
      Stamper signs and automatically publishes hashes of its history. It is a "block chain" in that sense: If Richardson decided to use the keys to backdate something to two years ago, he would have to fake two years of history, and risk being exposed if even one person came forward with a hash he'd signed contradicting his new fake history. That is presumably one of the reasons that hasn't happened in the roughly 30 years the service has been ticking along.
sp1rit 3y ago
> Are there any good solutions that would convince a non-technical judge? I feel like the best you can do is either to publish a cryptographically secure hash or to publish something encrypted and share the key/password when you want to reveal the secret.
- BoppreH 3y ago
  But publish it where, though? It has to be: - Publicly accessible. - Timestamped. - Immutable (or at least with edits marked as such). - Widely trusted (or too big to be bribed in small cases, e.g., Google). - And keep those features for many years. Twitter was surprisingly good at that in the past, but no more. Blockchains, as mentioned in other comments, give excellent immutability; but the field is such a minefield that I'd struggle to find a trustworthy blockchain explorer.
  - OkayPhysicist 3y ago
    Take out a personal ad in a newspaper.
  - __jonas 3y ago
    It's funny given the context of this case that this would be one of the rare times when using a blockchain would have actually been useful
  - 0cf8612b2e1e 3y ago
    Publish a document hash in the newspaper classifieds. Media should still be getting permanently archived by National Archive or Internet Archive.
  - fragmede 3y ago
    Why would you trust only one Blockchain explorer? You'd trust the blockchain by using several explorers, and by confirming that they all agree on the same value, to assuage any fears you have about any one particular blockchain explorer lying to you. Write your own, even, if your level of confidence needs to be that high.
  - 3y ago
SmooL 3y ago
This is/could be a legitimate use of blockchain, e.g. see https://gwern.net/timestamping https://gwern.net/timestamping
- BoppreH 3y ago
  Oh, there's a Gwern page about that. That's perfect, thanks for the link.
deleted 3y ago
[deleted]
OkayPhysicist 3y ago
For most purposes, mailing something to yourself for the postmark and keeping the envelope sealed would probably be adequate. It's possible to forge, but tricky enough.
- radlad 3y ago
  As far as I know, this is pretty much the gold standard. Note that you need to send First Class to get a postmark in the US - not standard Priority Mail.
- grkvlt 3y ago
  you realise it is possible to mail unsealed, open envelopes, right? doesn't seem that tricky...
  - neilkk 3y ago
    You seal the envelope with tape and put the stamp over the tape.
    - eequah9L 3y ago
      You send the envelope unsealed, then seal & stamp it later.
      - yencabulator 3y ago
        The word "stamp" is confusing here. You put postage on the letter, and the post office stamps the postage (to invalidate the postage). The stamp contains a date. You can't stamp something after having mailed it, that happens as part of the mail submission.
        eequah9L 3y ago
        OK, I suppose this could be arranged. The seal has to be over the whole of the "back side" of the envelope, where the flap is. Then put the address and the postage over that, and the post office stamps it. What confused me was how you would achieve post office stamping over a seal that's on the wrong side of the envelope, where the flap is.
weinzierl 3y ago
There used to be a service that published your hashes in the New York Times. Satoshi must have known about it because it is mentioned in the Bitcoin paper.
- deleted 3y ago
  [deleted]
nullc 3y ago
Allow me to plug my co-defendant's project: https://opentimestamps.org/ https://opentimestamps.org/
michaelt 3y ago
> But proving that an event happened before a certain time, like in the article, is a lot harder. If you know you're going to have to prove it, there are loads of options. Absolutely loads. The issue is simply that this guy's a fraud so he's gotta come up with a story about why he didn't use any of them.
mike_hearn 3y ago
> Are there any good solutions that would convince a non-technical judge? The judge in this case is actually very technical so that's not a problem. Regardless, the easiest and most direct way to timestamp something is to use the standard RFC 3161 timestamping servers. There are many, located in different countries and run by different people, and the format is straightforward and standardized. Support is built in to products like Acrobat. You can attach multiple timestamps from different sources to a single file. They are free. It can be explained to non-technical people in a not extreme amount of time, and courts / law firms in any country can easily find expert witnesses who can verify such timestamps and testify to the court as to their veracity. For emails there's also DKIM, which signs email including the date header. Again, plenty of people who can verify those signatures, so emailing something to someone else and then getting a copy of the raw email will do it (don't email to yourself, that skips the signing process). Disclosure: I took part in this trial as a witness and testified against Wright.
- sweetjuly 3y ago
  Note that DKIM does not necessarily sign the message contents. [1] DKIM is only really (in a general sense) intended to provide cryptographic proof that the originating server is permitted to send it. If you need a non-reputable, dated message, you really should use time stamping servers. [1] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail#Content_modification https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail#Con...
- TillE 3y ago
  Yeah it's odd to see a bunch of people proposing ideas for cryptographic timestamps (on the blockchain!) when anyone who has worked with digital signatures should know about RFC3161. Of course for verification it's important that the timestamp countersignature comes from a reputable CA and not some random server you set up.
blipvert 3y ago
If only there was some sort of globally distributed, cryptographically verified database of some sort that could be used for this purpose …
- fragmede 3y ago
  We'd first have to admit that Bitcoin isn't a total scam and might actually be useful for something, and we can't have that now, can we?
  - recursive 3y ago
    We would need to admit no such thing. In fact, it's possible that it's simultaneously not a scam, not practically useful, and also suitable for this purpose. Stuff on the block chain has a problem asserting anything that's not on the block chain, which is what a lot of people want to use it for. In this case, it's a bitcoin solution to a bitcoin problem. It's all in-universe so to speak.
- naniwaduni 3y ago
  The CT logs are a nifty place for this sort of thing!
password4321 3y ago
Post your SHA256 hash as a comment on a Hacker News story just before the 14 day edit window expires!
- gruez 3y ago
  The edit window is actually less than that, around 2 hours.
yencabulator 3y ago
It's so sad that roughtime didn't get widely adopted. https://news.ycombinator.com/item?id=12599705 https://news.ycombinator.com/item?id=12599705 https://news.ycombinator.com/item?id=12540941 https://news.ycombinator.com/item?id=12540941
mleonhard 3y ago
I worked on a public timestamping service: https://github.com/mleonhard/tokimark/ https://github.com/mleonhard/tokimark/

mananaysiempre 3y ago

Don’t know how convincing it’d be in court, but Open Timestamps[1], a free service that operates by publishing Merkle tree hashes to the Bitcoin ledger and can give you independently-verifiable proofs after a while, still exists even if it doesn’t seem to be under active development. (I think Keybase tried something like that some time ago as well, they already had most of the parts in place, but then they decided to use their own something-or-other-coin and I stopped paying attention.) [1] https://opentimestamps.org/ https://opentimestamps.org/

vintermann 3y ago
A good example of using bitcoin for something that was entirely possible with regular old public key cryptography. Matthew Richardson's Stamper has been running since 1995.
- rstuart4133 3y ago
  > Matthew Richardson's Stamper That was hard to find. My first google searches turn up this post. Here it is, in case anyone is interested: https://www.itconsult.co.uk/stamper/stampinf.htm https://www.itconsult.co.uk/stamper/stampinf.htm In the end both are just digital signatures, and so are "entirely possible with regular old public key cryptography" as you say. You can achieve a similar effect by sending a gmail message to yourself with an sha256 of the document in the subject. The subject and date are included in the gmail DKIM signature. The cryptographic primitives used by Stamper, gmail DKIM and bitcoin are equally secure as a first approximation. That means the security ultimately rests on the security of the key used to sign it. So do you trust Matthew Richardson to keep is gpg key secure, or Google to keep their DKIM secure, or the difficulty imposed by a proof of work where the amount of work is equal to a nation states electricity supply? I know which I'd choose out of those three, and that's the key differentiator of bitcoin. It is not the cryptographic primitives used.
  - vintermann 3y ago
    Stamper signs and automatically publishes hashes of its history. It is a "block chain" in that sense: If Richardson decided to use the keys to backdate something to two years ago, he would have to fake two years of history, and risk being exposed if even one person came forward with a hash he'd signed contradicting his new fake history. That is presumably one of the reasons that hasn't happened in the roughly 30 years the service has been ticking along.

sp1rit 3y ago

> Are there any good solutions that would convince a non-technical judge? I feel like the best you can do is either to publish a cryptographically secure hash or to publish something encrypted and share the key/password when you want to reveal the secret.

BoppreH 3y ago
But publish it where, though? It has to be: - Publicly accessible. - Timestamped. - Immutable (or at least with edits marked as such). - Widely trusted (or too big to be bribed in small cases, e.g., Google). - And keep those features for many years. Twitter was surprisingly good at that in the past, but no more. Blockchains, as mentioned in other comments, give excellent immutability; but the field is such a minefield that I'd struggle to find a trustworthy blockchain explorer.
- OkayPhysicist 3y ago
  Take out a personal ad in a newspaper.
- __jonas 3y ago
  It's funny given the context of this case that this would be one of the rare times when using a blockchain would have actually been useful
- 0cf8612b2e1e 3y ago
  Publish a document hash in the newspaper classifieds. Media should still be getting permanently archived by National Archive or Internet Archive.
- fragmede 3y ago
  Why would you trust only one Blockchain explorer? You'd trust the blockchain by using several explorers, and by confirming that they all agree on the same value, to assuage any fears you have about any one particular blockchain explorer lying to you. Write your own, even, if your level of confidence needs to be that high.
- 3y ago

SmooL 3y ago

This is/could be a legitimate use of blockchain, e.g. see https://gwern.net/timestamping https://gwern.net/timestamping

BoppreH 3y ago
Oh, there's a Gwern page about that. That's perfect, thanks for the link.

deleted 3y ago

[deleted]

OkayPhysicist 3y ago

For most purposes, mailing something to yourself for the postmark and keeping the envelope sealed would probably be adequate. It's possible to forge, but tricky enough.

radlad 3y ago
As far as I know, this is pretty much the gold standard. Note that you need to send First Class to get a postmark in the US - not standard Priority Mail.
grkvlt 3y ago
you realise it is possible to mail unsealed, open envelopes, right? doesn't seem that tricky...
- neilkk 3y ago
  You seal the envelope with tape and put the stamp over the tape.
  - eequah9L 3y ago
    You send the envelope unsealed, then seal & stamp it later.
    - yencabulator 3y ago
      The word "stamp" is confusing here. You put postage on the letter, and the post office stamps the postage (to invalidate the postage). The stamp contains a date. You can't stamp something after having mailed it, that happens as part of the mail submission.
      - eequah9L 3y ago
        OK, I suppose this could be arranged. The seal has to be over the whole of the "back side" of the envelope, where the flap is. Then put the address and the postage over that, and the post office stamps it. What confused me was how you would achieve post office stamping over a seal that's on the wrong side of the envelope, where the flap is.

weinzierl 3y ago

There used to be a service that published your hashes in the New York Times. Satoshi must have known about it because it is mentioned in the Bitcoin paper.

deleted 3y ago
[deleted]

nullc 3y ago

Allow me to plug my co-defendant's project: https://opentimestamps.org/ https://opentimestamps.org/

michaelt 3y ago

> But proving that an event happened before a certain time, like in the article, is a lot harder. If you know you're going to have to prove it, there are loads of options. Absolutely loads. The issue is simply that this guy's a fraud so he's gotta come up with a story about why he didn't use any of them.

mike_hearn 3y ago

> Are there any good solutions that would convince a non-technical judge? The judge in this case is actually very technical so that's not a problem. Regardless, the easiest and most direct way to timestamp something is to use the standard RFC 3161 timestamping servers. There are many, located in different countries and run by different people, and the format is straightforward and standardized. Support is built in to products like Acrobat. You can attach multiple timestamps from different sources to a single file. They are free. It can be explained to non-technical people in a not extreme amount of time, and courts / law firms in any country can easily find expert witnesses who can verify such timestamps and testify to the court as to their veracity. For emails there's also DKIM, which signs email including the date header. Again, plenty of people who can verify those signatures, so emailing something to someone else and then getting a copy of the raw email will do it (don't email to yourself, that skips the signing process). Disclosure: I took part in this trial as a witness and testified against Wright.

sweetjuly 3y ago
Note that DKIM does not necessarily sign the message contents. [1] DKIM is only really (in a general sense) intended to provide cryptographic proof that the originating server is permitted to send it. If you need a non-reputable, dated message, you really should use time stamping servers. [1] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail#Content_modification https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail#Con...
TillE 3y ago
Yeah it's odd to see a bunch of people proposing ideas for cryptographic timestamps (on the blockchain!) when anyone who has worked with digital signatures should know about RFC3161. Of course for verification it's important that the timestamp countersignature comes from a reputable CA and not some random server you set up.

blipvert 3y ago

If only there was some sort of globally distributed, cryptographically verified database of some sort that could be used for this purpose …

fragmede 3y ago
We'd first have to admit that Bitcoin isn't a total scam and might actually be useful for something, and we can't have that now, can we?
- recursive 3y ago
  We would need to admit no such thing. In fact, it's possible that it's simultaneously not a scam, not practically useful, and also suitable for this purpose. Stuff on the block chain has a problem asserting anything that's not on the block chain, which is what a lot of people want to use it for. In this case, it's a bitcoin solution to a bitcoin problem. It's all in-universe so to speak.
naniwaduni 3y ago
The CT logs are a nifty place for this sort of thing!

password4321 3y ago

Post your SHA256 hash as a comment on a Hacker News story just before the 14 day edit window expires!

gruez 3y ago
The edit window is actually less than that, around 2 hours.

yencabulator 3y ago

It's so sad that roughtime didn't get widely adopted. https://news.ycombinator.com/item?id=12599705 https://news.ycombinator.com/item?id=12599705 https://news.ycombinator.com/item?id=12540941 https://news.ycombinator.com/item?id=12540941

mleonhard 3y ago

I worked on a public timestamping service: https://github.com/mleonhard/tokimark/ https://github.com/mleonhard/tokimark/