Open pirate opened 7 months ago
@pirate Interesting concept! No, we haven't discussed this specific area. We have had some previous conversions about WARC, Internet Archives and such - but nothing about how TLS certs (or just server identity) applies.
Definitely something for us to consider!
Right now HTTPS/TLS does not support non-repudiation. https://security.stackexchange.com/questions/103645/does-ssl-tls-provide-non-repudiation-service
It's a huge problem for internet archiving, legal cases, and journalism because no one can provably verify that a server provided some specific content (without having to trust the client who recorded it to have not tampered with the recording).
Addressing the lack of non-repudiation could be done by signing packets inside a TLS session (or using some of the other providence techniques discussed by C2PA), and would allow the server hosting content to be provably part of the chain-of-custody.
This solves the problems of: