Kolaboro / Engineering / Signed photos

Signed site photos

The product we sell is a photo you can trust: this building, this week, taken by a person who works for you. A photo is easy to fake. These are the checks that make a fake expensive, and the ones that make it impossible to blame on someone else.

At the moment of capture

A one-time code from our server is burned into the corner of the photo with the time, and burned (used up) when the photo arrives. A photo taken earlier, or anywhere else, cannot carry today's code.
GPS must fall inside the plot. The plot is stored as a polygon; the server measures the distance from the photo's position to the boundary and records whether it is inside, with the GPS accuracy.
Time and quality. Photos older than 15 minutes, too blurry, too dark or too small are rejected with the reason, on the phone.
Never seen before. A perceptual fingerprint (64-bit difference hash) is compared with every accepted photo from other cases. A near-identical photo is rejected, even if cropped slightly or recompressed.
Signed by the agent's phone. New: the agent can register a passkey on their phone. Each photo fingerprint is then signed with that phone's key after Face ID or fingerprint (WebAuthn, user verification required). The private key never leaves the phone's secure chip, so neither Kolaboro nor anyone who steals the agent's password can produce a photo in their name.

challenge = SHA-256("kolaboro-capture-v1\n" + photo_sha256 + "\n" + capture_code) signature = phone_key.sign(authenticatorData || SHA-256(clientDataJSON)) // clientDataJSON contains the challenge

After capture

Each accepted item is chained to the previous one in its case (so removing one breaks the chain), the day's evidence is sealed into one hash and timestamped in Bitcoin, and that hash goes into the public log. Every item has a public, signed receipt at /api/open/receipt/{id}: fingerprint, chain position, times, whether it was inside the plot, whether the code matched, and for signed photos the full passkey assertion and public key. Our server checks the signature when it serves the receipt; kolaboro-verify.js lets you check it yourself with KV.verifyPhotoSignature(receipt).

What it does not prove

A signed photo proves which phone took which picture, when, where and that its owner unlocked it. It does not prove the building is sound. That is the agent's job, reviewed by a second person.