3 ms·

Here's my plan. 1. Cryptographically hash each piece of media when it's recorded. 2. Submit the hash to a "trusted" authority. 3. It will add a timestamp and

Here's my plan. 1. Cryptographically hash each piece of media when it's recorded. 2. Submit the hash to a "trusted" authority. 3. It will add a timestamp and sign the result. 4. Now, as long as you keep the original, without re-compressing, and you trust the authority, you have some evidence that the media existed at a timestamp. On or before. This doesn't prove authenticity, but in many cases, establishing a timestamp would be enough. Forgeries probably wouldn't be created until later, after the shit hit the fan. Or maybe this doesn't work at all.

AnthonyMouse 2y ago
Thieves are planning an inside job. They forge the surveillance video ahead of time, do the theft and submit the forgery to be timestamped while it's happening. Also, a lot of surveillance systems are purposely kept offline to prevent them from being compromised, but your system doesn't allow that because they would need external connectivity to get signatures.
- lolc 2y ago
  Sure when you're controlling the source, you can fake it. But requiring the fakes be prepared ahead of time locks the faker into one story that may be contradicted by other evidence.
  - AnthonyMouse 2y ago
    That's pretty much what happens anyway. The police are going to come collect the footage as soon as the crime is reported and you can't change it after they do.
- Edman274 2y ago
  This technique is known as an Ella Fitzgerald to those in the heisting industry, as popularized in the documentary Oceans 11.
  - AnthonyMouse 2y ago
    Oceans 11 is a work of fiction because most people don't have that skillset and the ones who do can make a lot of money doing honest work without risking a long prison sentence, so they're not tempted to rob casinos to heisting music. The issue here is that the skillset required to produce the forgery has fallen to the level that anybody can do it and then that's enough people that somebody actually does.
coppsilgold 2y ago
You can do this already by yourself or use a service which you need not even trust. Every x seconds, collect all the pieces of data that need to be notarized as existing in the world prior to some time t. It can be an arbitrary amount of data. Construct a Merkle Tree[1] of all the hashes (or HMACs) of all the data to be notarized. Compute the Merkle Root. Make sure that everyone gets their Merkle Proof (path from leaf to root) or publish the Merkle Tree publicly. Embed the Merkle Root into a one or more cryptocurrency blockchains to exploit their immutability guarantees. By either including it as "additional data" to some transaction or just straight up as a fictional cryptocurrency address. Every piece of data processed in this way will have a Merkle Proof (cryptographic path from hash of the data to the Merkle Root) that proves it existed prior to the creation of the Merkle Root. The Merkle Root will have its creation time bounded by the proof of work conducted on the cryptocurrency blockchain. [1] <https://en.wikipedia.org/wiki/Merkle_tree https://en.wikipedia.org/wiki/Merkle_tree>
- recursive 2y ago
  There are some tradeoffs here. You need to do currency transfers get a timestamp, with all the constraints that comes with. But you get probably a more trustworthy authority.
HPsquared 2y ago
Isn't this basically achieved by standard cloud storage on phones? Photos and videos get uploaded automatically (with authentication for the user account) and presumably that action is logged somewhere the user can't edit. Just need to prove those logs are secure, and there you go.
- echoangle 2y ago
  Unless you’re they police in a murder case, you’re probably not going to get google or apple to give you something that certifies that a file was uploaded before a specific time and not modified after. And just showing me the modification date in the UI wouldn’t convince me.
  - HPsquared 2y ago
    Much easier with the account holder's consent, it's probably in the "data download" thing you can request. And probably available by subpoena. It's like phone records. I don't mean "date modified" in the file metadata when it's uploaded (of course that could easily be spoofed before upload) but the actual "date uploaded". You know something must have been made before a certain time.

AnthonyMouse 2y ago

Thieves are planning an inside job. They forge the surveillance video ahead of time, do the theft and submit the forgery to be timestamped while it's happening. Also, a lot of surveillance systems are purposely kept offline to prevent them from being compromised, but your system doesn't allow that because they would need external connectivity to get signatures.

lolc 2y ago
Sure when you're controlling the source, you can fake it. But requiring the fakes be prepared ahead of time locks the faker into one story that may be contradicted by other evidence.
- AnthonyMouse 2y ago
  That's pretty much what happens anyway. The police are going to come collect the footage as soon as the crime is reported and you can't change it after they do.
Edman274 2y ago
This technique is known as an Ella Fitzgerald to those in the heisting industry, as popularized in the documentary Oceans 11.
- AnthonyMouse 2y ago
  Oceans 11 is a work of fiction because most people don't have that skillset and the ones who do can make a lot of money doing honest work without risking a long prison sentence, so they're not tempted to rob casinos to heisting music. The issue here is that the skillset required to produce the forgery has fallen to the level that anybody can do it and then that's enough people that somebody actually does.

coppsilgold 2y ago

You can do this already by yourself or use a service which you need not even trust. Every x seconds, collect all the pieces of data that need to be notarized as existing in the world prior to some time t. It can be an arbitrary amount of data. Construct a Merkle Tree[1] of all the hashes (or HMACs) of all the data to be notarized. Compute the Merkle Root. Make sure that everyone gets their Merkle Proof (path from leaf to root) or publish the Merkle Tree publicly. Embed the Merkle Root into a one or more cryptocurrency blockchains to exploit their immutability guarantees. By either including it as "additional data" to some transaction or just straight up as a fictional cryptocurrency address. Every piece of data processed in this way will have a Merkle Proof (cryptographic path from hash of the data to the Merkle Root) that proves it existed prior to the creation of the Merkle Root. The Merkle Root will have its creation time bounded by the proof of work conducted on the cryptocurrency blockchain. [1] <https://en.wikipedia.org/wiki/Merkle_tree https://en.wikipedia.org/wiki/Merkle_tree>

recursive 2y ago
There are some tradeoffs here. You need to do currency transfers get a timestamp, with all the constraints that comes with. But you get probably a more trustworthy authority.

HPsquared 2y ago

Isn't this basically achieved by standard cloud storage on phones? Photos and videos get uploaded automatically (with authentication for the user account) and presumably that action is logged somewhere the user can't edit. Just need to prove those logs are secure, and there you go.

echoangle 2y ago
Unless you’re they police in a murder case, you’re probably not going to get google or apple to give you something that certifies that a file was uploaded before a specific time and not modified after. And just showing me the modification date in the UI wouldn’t convince me.
- HPsquared 2y ago
  Much easier with the account holder's consent, it's probably in the "data download" thing you can request. And probably available by subpoena. It's like phone records. I don't mean "date modified" in the file metadata when it's uploaded (of course that could easily be spoofed before upload) but the actual "date uploaded". You know something must have been made before a certain time.