← Home

ANSAcheck … but why?

Edit-add: this article started as curiosity, to understand how ANSAcheck works. I added at the end the section ‘Other articles or videos on the same topic’, so we can mix the information we get.

ANSA has implemented ANSAcheck,

https://www.ansa.it/sito/static/ansa_check.html

“a solution that makes it possible to “certify” the ANSA origin of news thanks to Blockchain technology, which acts as a guarantor of transparency, security and openness of information.”

TL;DR;

The current ‘verification’ implementation involves steps that, as far as I can tell, third parties cannot actually carry out. Having to trust the ANSA.it domain, the whole thing seems pointless to me. 

Also, what is stored on the Ethereum blockchain is a specific ANSA ID (determinable, among other things, being a date), NO content HASH. Technically it is a blockchain timestamp of a specific ANSA ID, and I do not see the point.

Finally, the content published on the ANSA website does not match (at least in terms of events) what they report in the history on which the verification process is based.

My opinion

Disclaimer: I am a fan of blockchain technology, which has and can have several practical, sensible applications. But like any technology, it is not a panacea.

At a conceptual level (below I go deeper into the technical side), the practical user purpose of ANSAcheck escapes me.

If I read the made-up news “Chocolate cures covid19, ANSA news!”:

1- If it is on the ANSA site, it is authentic by definition (guaranteed by SSL on the domain), and a system like ANSAcheck is unnecessary.

2- If I read it on a different news outlet,

2.1 – If it does not show the ANSAcheck badge (p.s. so far I have not yet found an ANSA story republished by others that shows that badge), then the reader must look up the story on the ANSA site, and at that point we are back to point 1).

2.2 – If it shows the ANSAcheck badge (as a link to ansa.it), a) we are still at point 1), and b) it would have been enough for the badge to point to the original article on ansa.it, without the whole ANSAcheck round-trip.

It is NOT possible, starting from an article republished by a non-ANSA source, to obtain the data needed to query the blockchain without first going through the ANSA site. If I have to go through the ANSA site… see above.

Also, the data stored on the Ethereum blockchain is useless because it still requires trust in ANSA for any (currently impossible) third-party verification.

The upside is that ANSA now provides information such as when it edits a story, or the time between creation and publication. They could have called it ANSAopen instead, imho.
….
Update: NO — it happens that article dates on the ANSA site are later than the date of the last history event for the ‘certifications’, including the publication event date (and no, it is not about ITA vs UTC timezone). At the bottom in the notes there is an example plus other doubts of mine.

A step-by-step look

I will try to explain step by step what the public part of the system consists of, starting from a reference article as an example:

https://www.ansa.it/sito/notizie/cronaca/2020/04/06/buddisti-15-mln-euro-per-90-enti_f8dc8da1-5c4e-45f9-a839-047fd42363d7.html

ANSACHECK badge PAGE

The ‘badge’ link “ANSAcheck – Notizie d’origine certificata” points to

https://blockchain.check.ansa.it/landing/299de19d773a31c6a31a1b65233d4750/XCW7SUR847X047N

Here we have:

“MD5 News”: I currently do not know how it is computed. It is NOT the MD5 of the title, and I find no documentation about it.

“MD5 Contenuto”: It should be an MD5 hash. Clicking the arrows lets us see the body of the story, which pasted into https://www.md5hashgenerator.com/ for third-party hash verification produces a different hash (note: the same independent method later works on the block body, so clearly they are not showing the exact text they used to generate their MD5 hash).

We have the list of ‘events’ related to the story — in this case two events, registration and publication.

Let us analyse the registration event

ANSA has the concept of a block in which it stores X events, which is NOT a blockchain block.

This is because they clearly do not save EVERY event on the Ethereum blockchain (would the fees cost too much?), but group X events into an ANSA block of their own and ‘certify’ that. In our case study it is block AC202004061245 (again, an internal ANSA code).

ANSACHECK CERTIFICATE

Clicking “CERTIFICATO ANSACHECK” we arrive here:

https://blockchain.check.ansa.it/certification/AC202004061245

which as said represents the block, i.e. a set of articles/news/events, not the original story alone.

Here we see:

  • The BLOCK ID, the one referenced by the URL we are looking at
  • The BLOCK HASH.
    It is the MD5 hash of the JSON cited below under “Informazioni contenute nel blocco”.

Independent check: click the ‘copy to clipboard’ button, go to https://www.md5hashgenerator.com/, paste, it generates 1e52cc6ff8daeff462cab1461eb18f0a
which is exactly the hash cited as BLOCK HASH. The detail of the information in the block is covered later. At least this round worked.

INFORMATION CONTAINED IN THE BLOCK

It is a JSON with the various records of the block; in our example

 {
        "id": "5029aaf4545931352300a1dd86eaffbe",
        "title": "Coronavirus: Buddisti, 1,5 mln euro per 90 organizzazioni",
        "content_hash": "9a08dcdf83759174fc97ae2f971e3a1b",
        "event": "publication",
        "timestamp": "2020-04-06T12:31:50.000Z"
 },
  • ID – unique internal ANSA ID
  • Title – Title
  • Content Hash – This is the cathartic part. 99% likely another MD5, but it is unclear (and it should be clear, otherwise the whole thing collapses) how a third party can compute it.
  • Event – Type (I will not detail the various enums; it does not matter)
  • Timestamp – Date

ETHEREUM TRANSACTION

The custom data saved on the blockchain appears to be this:

They saved the ANSA block ID; there is NO HASH saved on the blockchain.

Moreover, the ANSA block ID is determinable (it looks like a date in AC + date (of the block?) format in ISO 8601 without delimiters).

Simone Cosimo in a Medium article analyses the Ethereum smart-contract source in more detail, including bytecode decompilation and analysis.

I remind you that in the past there have been very serious bugs in writing smart-contract source code (e.g. the DAO on Ethereum: https://medium.com/@ogucluturk/the-dao-hack-explained-unfortunate-take-off-of-smart-contracts-2bd8c8db3562). 

As a curiosity, you can see what they pay in $ to store this information and other details (currently about $0.07 every twenty or so events, roughly).

RUN VERIFICATION

The ESEGUI VERIFICA button appears to verify that the block as seen by ANSA matches the one on the blockchain.

It does NOT verify the original story; at no point does it use the original text of the story, nor does it compute the block’s content_hash values.
Technically it does ‘something’ client-side in JavaScript, with a single AJAX call.

To me this is pure marketing, because the whole procedure in practice asks itself for verification, querying itself (an AJAX request to an ansa.it subdomain). It would have been a bit better if there were AJAX requests to a third-party Ethereum explorer.

It could fail only in the following cases:

  • ANSA.it has been compromised (block data altered). Irrelevant, because at that point the verification process itself could be compromised and always return SUCCESS.
  • The Ethereum blockchain has been compromised. But if that could happen, then they might as well have used a MySQL database guaranteed by ANSA as the trusted source.

The verification output is:

Verifying ANSAcheck Block AC202004061245 certification …
Calculating MD5 of AC202004061245 content…
Input: [{"id":"b58b3c33e6202623385efe15995a2deb","title":"Coronavirus: Ascani, confronto sia su come tornare a scuola","content_hash":"f8a53969fbec0be49690b034bfd2b9fc","event":"publication","timestamp":"2020-04-06T12:30:49.000Z"},{"id":"6ba06e89dc21f538f0dd01723807602e","title":"Coronavirus: giustizia per Bergamo, 30mila firmano petizione","content_hash":"7990e39976eaf11a720599989b26e217","event":"publi.....
Output: 1e52cc6ff8daeff462cab1461eb18f0a
Calling getter on ANSAcheck smartcontract to retrieve information…
Input: getNewsChain(AC202004061245)
Retrieved information: 1e52cc6ff8daeff462cab1461eb18f0a
Hash matches! News verified successfully!

In detail, line by line:

Verifying ANSAcheck Block AC202004061245 certification …

Fair enough.

Calculating MD5 of AC202004061245 content…

To what end? It is all in-house; you are asking yourself.

Input: [{"id":"b58b3c33e6202623385efe15995a2deb","title":"Coronavirus: Ascani, confronto sia su come tornare a scuola","content_hash":"f8a53969fbec0be49690b034bfd2b9fc","event":"publication","timestamp":"2020-04-06T12:30:49.000Z"},{"id":"6ba06e89dc21f538f0dd01723807602e","title":"Coronavirus: giustizia per Bergamo, 30mila firmano petizione","content_hash":"7990e39976eaf11a720599989b26e217","event":"publi.....

Ok, it is computing 1e52cc6ff8daeff462cab1461eb18f0a, all stuff it already has in-house — looks like theatre.

Output: 1e52cc6ff8daeff462cab1461eb18f0a

Ok.

Calling getter on ANSAcheck smartcontract to retrieve information…
Input: getNewsChain(AC202004061245)

It made an AJAX request to
https://scl.check.ansa.it/api/ncblock/AC202004061245/transaction
getting as response the JSON

{"get_news_block":"1e52cc6ff8daeff462cab1461eb18f0a"}
Retrieved information: 1e52cc6ff8daeff462cab1461eb18f0a

In practice it called itself (still ansa.it) to obtain the same hash 1e52cc6ff8daeff462cab1461eb18f0a mentioned above. I presume something server-side queried the Ethereum blockchain to get that hash, but we have to trust that (so what is the point? shrug). 

Hash matches! News verified successfully!

So it compared the hash computed in the first phase with a hash obtained in the second.

They match, “verified successfully!”.

Both operations are done by ANSA, not a third-party verification. The step-by-step effect, about one second apart, looks like theatre to me.

Miscellaneous notes

  • It is unclear to me why open standards were not used, for example https://opentimestamps.org/ (just kidding — I imagine it is clear to everyone…).
  • It is unclear to me why the Ethereum blockchain was preferred over Bitcoin, which has a much higher hashrate — in the blockchain world that means more secure (less susceptible to attacks).
    The answer should be the use of smart contracts, but without details, everything done so far could perfectly well have been stored in Bitcoin TX OP_RETURN.
    Moreover Ethereum will have to switch from proof-of-work to proof-of-stake, a technology essentially never tested in production at this scale — but those are debatable points.
  • I find the use of MD5 instead of at least SHA-256 questionable. MD5 has been considered obsolete for over a decade. In 2006 Vlastimil Klima wrote an algorithm able to find an MD5 collision in a minute on a Pentium notebook: https://eprint.iacr.org/2006/105.

    I do not know what it would take to take an article citing a number (for example funds allocated in a government budget), add a couple of zeros to the amount and enough invisible characters to get a collision (the same MD5 as the original story). At a glance I think it is feasible, but I am not a cryptographer.
  • “MD5 News” and “MD5 Contenuto” and the “content-hash” of individual events do not seem computable (or do not match) for a third party.
  • The entire “verification process” part is totally useless and irrelevant. In practice it tells itself “ok I am trustworthy”.

I will stop here for now. Congratulations if you read this far — thanks.

Addition 9 April 2020 – Whitelist of sites allowed to view history

@bellapersonaa pointed out to me that starting today, any link to an ANSAcheck card (example) is allowed only for a list of sites (whitelist) decided by ANSA; otherwise:

Image

The “CHIUDI” button closes the window, preventing you from viewing “La storia di questa notizia” (unless you use technical tools).

Practical reflection: ANSA publishes a fake news item. ANSA scrubs it. If there is no link to the badge of the scrubbed story on the ANSA site, viewing the history of that scrubbed story is blocked.

Technical reflections (they check the HTTP ‘Referer’ header):

  1. This list of accepted Referers does not appear to be public.
  2. The header is optional and can be disabled, with the consequence that that message might be shown EVEN if I view the story from ansa.it itself.
  3. There are best practices (via Referrer-Policy or Content-Security-Policy) that may specify not to forward the Referer (usually for privacy). But we hope that sites hosting ANSAcheck verification will never be able to do that (← irony).

Curious that it was introduced like this, days after the system announcement. It almost looks like an idea invented on the fly, not planned in the initial system design.

Article history

8 April 2019: First version of this article
9 April 2019: Added references to other articles on the same topic
9 April 2019: Added the section “Whitelist of sites allowed to view history”

Other articles or videos on the same topic

ANSACheck Deep Dive – by Simone Cosimo – Goes especially deep into the Ethereum smart contract

CERTIFICAZIONE BLOCKCHAIN DI ANSA? – YouTube video, especially highlighting the mismatch between data shown on the ANSA site and data published in their history (the basis of the ANSAcheck system).