Out of curiosity, how one is supposed to "document it properly"?

g-b-r 2 days ago | parent | next [-]

You can obtain a cryptographic proof by recording the tls exchange, including the keys

You need to use a tls intercepting proxy for that.

I couldn't find any ready-made tool unfortunately, there's tlsnotary.org but it seems far from simple.

So basically I record what the browser sends to the server when I click the toggle and the server response?

I wonder how I can attach a timestamp that cannot be faked.

amelius 2 days ago | parent | next [-]

Look into court-grade eDiscovery Software.

Specifically forensic web preservation or web capture tools.

PS: If they made it impossible for you to prove that you clicked a checkbox or not, then, logically, the burden of proof is on THEM.

	▲	g-b-r 2 days ago \| parent [-]
		That Wikipedia article seems to have no bearing on the issue; there's not even any log on a normal user's computer of having or not having clicked a checkbox. > If they made it impossible for you to prove that you clicked a checkbox or not, then, logically, the burden of proof is on THEM Even in Europe the only "proof" that's required to companies is a log or database entry (both easily manipulated); if a user strongly disputed to have done it and sued the company for that, maybe you'd able to obtain some investigation on their systems.

g-b-r 2 days ago | parent | prev [-]

If you have the TLS session with all the keys, that's signed with the server's key, so it's basically certified by them themselves.

They could only claim that it's been faked by claiming that you stole their TLS private key.

2 days ago | parent | prev [-]

[deleted]