← Back to context Comment by vb-8448 1 day ago Out of curiosity, how one is supposed to "document it properly"? 6 comments vb-8448 Reply g-b-r 19 hours ago You can obtain a cryptographic proof by recording the tls exchange, including the keysYou need to use a tls intercepting proxy for that.I couldn't find any ready-made tool unfortunately, there's tlsnotary.org but it seems far from simple. vb-8448 18 hours ago So basically I record what the browser sends to the server when I click the toggle and the server response?I wonder how I can attach a timestamp that cannot be faked. amelius 16 hours ago Look into court-grade eDiscovery Software.https://en.wikipedia.org/wiki/Electronic_discoverySpecifically forensic web preservation or web capture tools.PS: If they made it impossible for you to prove that you clicked a checkbox or not, then, logically, the burden of proof is on THEM. 1 reply → g-b-r 15 hours ago If you have the TLS session with all the keys, that's signed with the server's key, so it's basically certified by them themselves.They could only claim that it's been faked by claiming that you stole their TLS private key.
g-b-r 19 hours ago You can obtain a cryptographic proof by recording the tls exchange, including the keysYou need to use a tls intercepting proxy for that.I couldn't find any ready-made tool unfortunately, there's tlsnotary.org but it seems far from simple. vb-8448 18 hours ago So basically I record what the browser sends to the server when I click the toggle and the server response?I wonder how I can attach a timestamp that cannot be faked. amelius 16 hours ago Look into court-grade eDiscovery Software.https://en.wikipedia.org/wiki/Electronic_discoverySpecifically forensic web preservation or web capture tools.PS: If they made it impossible for you to prove that you clicked a checkbox or not, then, logically, the burden of proof is on THEM. 1 reply → g-b-r 15 hours ago If you have the TLS session with all the keys, that's signed with the server's key, so it's basically certified by them themselves.They could only claim that it's been faked by claiming that you stole their TLS private key.
vb-8448 18 hours ago So basically I record what the browser sends to the server when I click the toggle and the server response?I wonder how I can attach a timestamp that cannot be faked. amelius 16 hours ago Look into court-grade eDiscovery Software.https://en.wikipedia.org/wiki/Electronic_discoverySpecifically forensic web preservation or web capture tools.PS: If they made it impossible for you to prove that you clicked a checkbox or not, then, logically, the burden of proof is on THEM. 1 reply → g-b-r 15 hours ago If you have the TLS session with all the keys, that's signed with the server's key, so it's basically certified by them themselves.They could only claim that it's been faked by claiming that you stole their TLS private key.
amelius 16 hours ago Look into court-grade eDiscovery Software.https://en.wikipedia.org/wiki/Electronic_discoverySpecifically forensic web preservation or web capture tools.PS: If they made it impossible for you to prove that you clicked a checkbox or not, then, logically, the burden of proof is on THEM. 1 reply →
g-b-r 15 hours ago If you have the TLS session with all the keys, that's signed with the server's key, so it's basically certified by them themselves.They could only claim that it's been faked by claiming that you stole their TLS private key.
You can obtain a cryptographic proof by recording the tls exchange, including the keys
You need to use a tls intercepting proxy for that.
I couldn't find any ready-made tool unfortunately, there's tlsnotary.org but it seems far from simple.
So basically I record what the browser sends to the server when I click the toggle and the server response?
I wonder how I can attach a timestamp that cannot be faked.
Look into court-grade eDiscovery Software.
https://en.wikipedia.org/wiki/Electronic_discovery
Specifically forensic web preservation or web capture tools.
PS: If they made it impossible for you to prove that you clicked a checkbox or not, then, logically, the burden of proof is on THEM.
1 reply →
If you have the TLS session with all the keys, that's signed with the server's key, so it's basically certified by them themselves.
They could only claim that it's been faked by claiming that you stole their TLS private key.