Hi,
Ralf and I would love to hear the feedback of HN about the idea of using bank transfers to store a hash of a document and use this for priority statement (to prove that you had the document at a certain date).
Our goal is to spread the free idea since we do not think it is used a lot. We created web and windows software to help people computing a sha256 of their document.
Any feedback is welcomed. Thanks
Our main goal is to help spread the word and see others using this technique. Implementation is not so difficult since only a hash, but if you want to contribute or implement it, sure.
We are also curious about these two points since we did not investigate all jurisdictions. We will try to learn more for countries different than Germany and update the website.
Hi, This was also the feedback we had from /r/crypto on Reddit. You are right, the blockchain would be completely fine and could be even more automated. But we think that bank statement are more familiar to judges. Banks have to duty to keep the statements and be able to issue an official copy when requested for a few decades.
Cuter, yes, but probably not measurably better from a security perspective, unless your threat model includes adversaries who can change the internal records of two separate banks.
The advantage of using bank transfers is it is much easier to explain to a judge/jury.
Bitcoin is public and automatable, so it could be better for some applications where courts aren't involved -- but where would you need to categorically prove priority but not have a court at least potentially involved?
> The advantage of using bank transfers is it is much easier to explain to a judge/jury.
This seems like a really weak argument.. There are all types of things judges don't understand outright but can be made to be understood. The chance of a priority being granted to a hash embedded to a bank transfer and not a block-chain embedded one is essentially zero (all things being equal). Since it is both cheaper and more robust, a super-secure blockchain like bitcoin is clearly superior to a bank transfer.
Is this any better than using pastebin? One may argue that banks are more trusted for storing money than pastebin is for data, but is there another reason?
As you can read in the translation of the original article[0], the difference here is that banks must archive data about bank transfers for at least 10 years (in Germany), and are obliged to hand out this information on request. PasteBin does not guarantee this and may also not allow you to store a private document.
When standing in court trying to prove that you wrote something at a point in time, the judge is more than likely going to accept a bank statement than pastebin.com.
You could probably get the same effect by just sending an e-mail using Gmail (or equivalent online service that wont let you modify its internals) though?
Seems much simpler, and you don't have to explain hashes to anyone....
Judge: "The SHA1 hash in the bank transfer dated 1 Jan matches the hash I calculated for the document you supplied me, so you must have had access to the document on 1 Jan. I believe you"
In reality...
Judge: "Wait, you sent an e-mail with this document on 1 January?"
You: "Sure, here's my gmail account. See this screenshot"
Judge: "Well, that sorts it"
It seems the online tool does nothing other than compute the SHA-1 hash. Given that it seems the documents that a user would want to hash for this method are likely to be sensitive, it seems prudent to suggest that users use an offline method of generating the hash.
Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You can read its sources to be sure about this.
That would require every user to validate the sources themselves.
See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)
We should dynamically compute a hash of the source files client-side and compare it with a previous hash validated by a trusted third party and available online. If they don't match, the client displays a red warning :)
I don't understand this point. In any case, the point is that we may trust your site today, but it may be compromised in the future. In which case it also can't be trusted to show any sort of warning.
Good idea in theory but it doesn't really work.
If someone (like you) can change the code that the client gets then they can simply remove or fake the hash checking code.
Am I the only one that doesn't think this idea is particularly new or interesting? My cryptography professor in undergrad talked about the idea of hashing your work and publishing the hash in the classifieds of a newspaper as a publicly verifiable way to timestamp it. That was like 10 years ago and I don't think the idea was new at the time.
We don't pretend the idea is new (although Ralf did not find prior scientific works talking about this). We just want it to spread since it is simple and cheap.
A quick Google shows there is a good deal of prior published work on the idea of time stamping with hashes. The Wikipedia articles on the topic lists published references as early as 1991 and notes that the general idea itself dates to 1660 when Robert Hooke of Hooke's law fame published an anagram in a newspaper to timestamp his discovery.
On another note, is using a bank transaction as a means of publishing even a good idea? The banks I use only keep recent transactions available online, between 6 months to two years. So, you would have to print out your bank statement save it and present that as the proof which isn't particularly convincing. With a newspaper anyone can go find a copy of that newspaper at a library and independently verify it. They won't be able to get your private bank records w/o a lot of hassle.
Citing the original document "Der Klassiker für diese Methode ist, den Hash-Wert des Inhalts einer Datei in einer gedruckten Zeitung zu veröffentlichen. "
author prefers the bank over newspaper due to lower costs + amount of time .
What actual (as opposed to 'theoretical') problem does this solve? I understand it solves the fictitious 'prior art' problem many technical people think exists, but which few or no people who actually do patent stuff I know consider to be a real issue. Then again I haven't done any actual research on whether it is an issue, I'm just wondering if anybody with a legal background was involved in this.
(disclaimer: I have a law degree but have never practiced and have only ever written a few papers on patent matters, none of which directly involved the issue at hand).
Do you also store the original document? From a quick overview it seems you only store the hash. A typical situation that might occur is that a client hashes his document, a couple of years later he want to proof priority but doesn't have the original document anymore (perhaps he appended it, fixed spelling errors etc). Now his priority statement is worthless.
Why not provide a facility for the client to store his document along with the hash, encrypted off course. He can encrypt the document himself or you can provide an application that does it for him.
If you were going to hash your document and store the hash in a bank transfer comment field, then it would be in your interest to make sure you don't modify the document in any way.
Why not just push your work to a private GitHub repo? That would establish priority and ownership in a much clearer way than inserting a hash into a bank transfer.
I really think hashing the work causes more problems than it solves.
46 comments
[ 3.9 ms ] story [ 121 ms ] threadDo banks have to maintain the "Comments" by law?
The advantage of using bank transfers is it is much easier to explain to a judge/jury.
Bitcoin is public and automatable, so it could be better for some applications where courts aren't involved -- but where would you need to categorically prove priority but not have a court at least potentially involved?
This seems like a really weak argument.. There are all types of things judges don't understand outright but can be made to be understood. The chance of a priority being granted to a hash embedded to a bank transfer and not a block-chain embedded one is essentially zero (all things being equal). Since it is both cheaper and more robust, a super-secure blockchain like bitcoin is clearly superior to a bank transfer.
Create a forgery-proof timestamp for your data, secured by the bitcoin network.
http://vog.github.io/bitcoinproof/
0: http://rschoenm.github.io/prioprepare/article.html
When standing in court trying to prove that you wrote something at a point in time, the judge is more than likely going to accept a bank statement than pastebin.com.
Seems much simpler, and you don't have to explain hashes to anyone....
In theory...
Judge: "The SHA1 hash in the bank transfer dated 1 Jan matches the hash I calculated for the document you supplied me, so you must have had access to the document on 1 Jan. I believe you"
In reality...
Judge: "Wait, you sent an e-mail with this document on 1 January?" You: "Sure, here's my gmail account. See this screenshot" Judge: "Well, that sorts it"
See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)
https://rawgithub.com/kristofferkoch/web-lafs/master/test/sh...
If priority matters for you, it costs about $100 to file a provisional patent application and that's what you should do.
http://en.wikipedia.org/wiki/Linked_timestamping
http://en.wikipedia.org/wiki/Trusted_timestamping#History
On another note, is using a bank transaction as a means of publishing even a good idea? The banks I use only keep recent transactions available online, between 6 months to two years. So, you would have to print out your bank statement save it and present that as the proof which isn't particularly convincing. With a newspaper anyone can go find a copy of that newspaper at a library and independently verify it. They won't be able to get your private bank records w/o a lot of hassle.
author prefers the bank over newspaper due to lower costs + amount of time .
For example a crypto currency block-chain.
(disclaimer: I have a law degree but have never practiced and have only ever written a few papers on patent matters, none of which directly involved the issue at hand).
Why not provide a facility for the client to store his document along with the hash, encrypted off course. He can encrypt the document himself or you can provide an application that does it for him.
Charge extra for this feature...
I really think hashing the work causes more problems than it solves.