I have found a few vulnerabilities that I want to sell (legally!).

In case they get publicly revealed before I manage to sell them, I want to be able to prove that I knew about them before that for bragging rights.

I am currently considering the following system (if you see a better alternative, I'd like to hear that as well):

  • SHA-2 encode a date marker (2000-01-01) + a description of the vulnerability
  • publish the SHA-2 on a web-app that keeps it's date
  • if it gets publicly revealed in the future, I can publish my description, and anyone can verify that it generates the SHA-2, and the date that the SHA-2 was published

For this method to work, I need a webapp that:

  • keeps a timestamp for a given data
  • does not allow me to modify the data without altering the timestamp, and will not allow that in the future
  • allows everyone to see the timestamp publicly
  • is not likely to disappear tomorrow (of course, this is a "soft" requirement, but also an important one)
  • allows me to publish any data I want (excludes, say, Stack Overflow which only allows programming questions)
  • keeping the SHA timestamps hidden before disclosure would be a plus but not required: that would hide the vulnerability count, which is desirable but not crucial to me. This could be achieved with "undoable delete" functionality like for Stack Exchange answers or other privacy control mechanisms.
  • does not produce notifications to people who are not concerned. E.g., I don't want to publish on my main Facebook timeline so as to not spam my friends. I could create a fake account, but it may be against Facebook's ToS (TODO)

A few options I have considered are:

  • email myself. But I can't make an email publicly visible AFAIK
  • big social media with posts / comments: might be used, but I'm afraid they change the timestamp rules at some time since it's not their design goal:

Does anyone see a better option?


After Grant gave me the keyword "Trusted timestamping", I found other sources:

Also there is one thing I should improve in my system: my name <email> pair should be included inside the files to be hashed.

  • Bitcoin can be used to do this...but I don't know exactly how it works well enough to write it as an answer.
    – Grant
    Nov 23, 2014 at 22:33
  • @Grant yes, I was thinking about those techniques as well, heard people even got married like that, but I don't know the details either. Nov 23, 2014 at 22:38
  • bitproof.io is a blockchain based solution backed by a startup. May 27, 2016 at 8:56
  • How about the old-fashioned method of documenting everything on paper, putting it in a sealed envelope that you have time-stamped and kept by a notary? Sounds much easier (faster) and reliable. Yes, it will cost you some money, include that in your selling costs.
    – user416
    May 27, 2016 at 10:22
  • @JanDoggen the blockchain might be safer than any notary, and with the services mentioned on answers, likely faster and less expensive ;-) May 27, 2016 at 10:37

2 Answers 2


One option is https://www.btproof.com

It takes your text and creates a hash of it - turns that hash into a bitcoin address and sends some money there. This creates a permenant (at least as long as someone has a full copy of the bitcoin chain) record of the hash, with an incredibly difficult to forge timestamp. The money sent to the address is lost forever.


You could publish cryptographic hashes of file X in the Classified Ads of your local newspaper. If anyone subsequently disputes that file X existed on the newspaper's publication date, refer them to the newspaper and send them a copy of file X (which, of course, you backed up in several places).

  • This is likely to work. But why is it better than the blockchain solutions? Jun 6, 2016 at 21:20
  • It's not better, but it gives you one less thing to explain if you're dealing with people who believe that blockchains are the instruments of drug dealers and enemies of the state.
    – user24227
    Jun 8, 2016 at 16:19
  • Having greater validity in court is a very concrete advantage. If you find any precedents, add them in :-) Jun 8, 2016 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.