8 ms·

I don't get the magical power of a signature at all. Everybody can write my name under a document. This project basically allows you to forge your own signatur

I don't get the magical power of a signature at all. Everybody can write my name under a document. This project basically allows you to forge your own signature. Is it still legally binding? Do these rules even remember the original intent?

shinryuu 7y ago
The question is, can you forge your own signature? If both parties agree that the document is legally binding it seems a bit unlikely that the document would fall under the forged label. Though I am not a lawyer. It's also worth noting that digital signatures throughout the european union have legal status.
- toomuchtodo 7y ago
  Digital signatures also have legal status in the US. Until society catches up and uses cryptographic primitives provided by a national ID smart card (such that Estonia has) for authorizing intents, this is a satisfactory method to make document execution less painful. This project is already doing the easy part (“place pretty signature picture here”). Depending on your jurisdiction and their tolerance, you could also render a true crypto signature in ascii-armored format to assist in proving legitimacy (perhaps generated as a small print signature line under the signature). Sidenote: Some transactions require a "wet" signature (as in, actual ink on actual paper from an actual pen). This doesn't get around those transactions unfortunately.
  - zo1 7y ago
    All the more baffling why some countries are moving away from national identification and other digital signing initiatives to prove identity. E.g. the UK that introduced and then subsequently dismantled a national ID card and database (apparently it was a "privacy" issue for the government to have a record of citizens?). Imagine this, a first world country, living in the dark ages essentially when it comes to identity.
    - toomuchtodo 7y ago
      If you support national ID systems, please do your part to advocate for such systems whenever possible (as well as the necessary privacy and oversight controls). Progress is a function of effort. I'm working on the US side.
    - michaelt 7y ago
      > (apparently it was a "privacy" issue for the government to have a record of citizens?) That's because there's a 95% chance they'll sell it to the likes of Equifax and Experian - what minister could resist the temptation to 'make the system pay for itself' while 'reducing fraud' and 'working with the private sector' - and a 100% chance one of them will then lose it in a breach.
    - VBprogrammer 7y ago
      Just for what it's worth, a big part of the backlash against the national ID is that firstly we have a couple of decent proxies, for example driving licence and passport, and secondly we were being asked to pay for the privilege.
    - minikites 7y ago
      Many people in the USA believe a "national ID" card is the work of actual Satan: https://countdown.org/en/entries/features/national-id-cards-and-mark-beast/ https://countdown.org/en/entries/features/national-id-cards-... >These ID cards are, however, preparing the way. The more people get used to some new government regulation, restriction, or provision, the more they tolerate it and eventually just learn to live with it. What may at first seem unthinkable and raise howls of protest, later becomes accepted by a few, then many, then most. And that’s how the Antichrist and his agents will capitalize on these compulsory ID cards to prepare the world for what’s next.
      - fastball 7y ago
        I think "many" might be overselling it a bit relative to a population of ~330M.
        7y ago
  - AnthonyMouse 7y ago
    > national ID smart card National ID systems are an incredibly bad idea. You can already get the entire authentication benefit from using decentralized ID systems (your bank authenticates you with your bank card, your employer authenticates you with your employee ID), so all a national ID adds is the ability for corporations to correlate all your different identities without your knowledge or consent, which is nothing but a privacy-invasive misfeature. Note that without a centralized ID they could still do it with your knowledge and consent by having you authenticate using multiple decentralized IDs. Centralized identity is also a huge single point of failure and compromise. It would attract far higher resources from attackers than non-monoculture ID systems do, have far reaching consequences when vulnerabilities are discovered, and take far longer to respond when changes are necessary because of the scope of use.
    - fastball 7y ago
      I think you're forgetting the part where those existing so-called "decentralized" ID systems are by-and-large using a centralized system (your SSN) which is magntitudes worse than a cryptographic card. Your bank knows that you are the same John Smith as your employer has on record, because you needed to use the same SSN for both. The status quo is that any service which requires identity validation is requiring you to provide your SSN, which in internet terms is like authenticating with only a username (no password) on all websites, AND you have to use the SAME username for every different site. Now compare that to public-key encryption. Not only is it better assuming you only have access to a single private key (because you are still authenticating with the output of the key, not the key itself as with SSN), but also because a cryptographic card could store MULTIPLE private keys, allowing you to authenticate with a different "identity" to different providers, making it impossible for them to cross-reference you in that way.
      - brewdad 7y ago
        You do need the SSN to match up with the name and other personal information like age, gender, address, etc. In that way, it's a bit like authenticating with a common username and a password that is publicly available with the username obfuscated (except in the case of data leaks).
- PeterisP 7y ago
  You seem to be conflating the two different, incompatible meanings of "digital signatures" here. This article is about digital signatures as in digital pictures of a signature. There's some support of them in, for example, some PDF tools. These do not have a legal status in EU. And there are "digital signatures" as in cryptographic digital verification of documents using private/public key cryptography. This is the type of digital signatures for which EU has a legal status, and in many countries a support for verifying identity - for example, I can cryptographically sign documents using the chip on my gov't ID card, and if I receive such a document, then I can securely verify the identity of the signer without needing any preexisting relationship with them. But this has nothing to do with the pictures of signatures that this article is talking about, that seems to be more like a USA thing.
jabroni_salad 7y ago
The act of marking the sig field shows your intent to bind to the contract. You can digitally sign but there are a couple extra steps to confirm the intent and identity that aren't hard but are just hard enough to make DocuSign a lot of money and leave everybody else to print/sign/scan their stuff.
- arkanciscan 7y ago
  So you're saying the signature itself is irrelevant? It's just an elaborate checkbox? The question then is how do you prove I was the guy who checked the box?
  - xnyan 7y ago
    It’s sort of is actually. What really matters is the providence of the approval, the adult trail or whatever you want to call it. You are creating a record of when and that you agreed to something and the signature is an artifact of that agreement. A signature is somewhat harder to take them and checking a checkbox and can be somewhat more easily traced back to the signatory, so it’s probably somewhat better than a checkbox.
    - loopdoend 7y ago
      Audit trail... see also companies like Jornaya that specialize in making any form interaction auditable for consent to receive marketing.
    - oneplane 7y ago
      So in hipster terms: it's a paper blockchain that isn't immutable and has no real identity ;-)
      - edmundsauto 7y ago
        And is pretty easy to forge collisions.
      - Spivak 7y ago
fimdomeio 7y ago
In a way I don't think it's possible to forge one's own signature. What's the diference of my signature from the forgery of the signature I did myself? Signature on a piece of paper says "I read this and agree with what's written so I've put a unique piece of ink there to show my agreement" doesn't really matter what you put there if all parts agree on its validity.
- arkanciscan 7y ago
  But what if you aren't the one who forged your own signature? How are you going to prove that someone else scribbled something on a PDF?
  - mannykannot 7y ago
    The forging of a signature has always been a possibility, which is why witnesses are required for the important stuff. On the other hand, you would be right in thinking that there is a somewhat anachronistic element of theater in having signatures on electronic documents.
    - mattkrause 7y ago
      In some ways, the theater is the point: the more elaborate the “production”, the easier it is to demonstrate that the required “meeting of the minds” took place. Someone might blithely—-or accidentally—-click continue, but you can’t really sleepwalk your way through signing a document or lining up witnesses to the signing.
    - mr_toad 7y ago
      > The forging of a signature has always been a possibility Yes, but it used to be difficult. If you can lift an image off one piece of paper and print it on another it becomes easy. It’s no different than paper currency. If it’s easy to forge, then the real money becomes worthless.
sbarre 7y ago
> Do these rules even remember the original intent? You are describing bureaucracy. There are plenty of people who work (and live) by rules that no longer make sense, but hey, they're the rules!
- TeMPOraL 7y ago
  Just because something can be forged doesn't mean it's useless. Signature in isolation doesn't mean anything, the surrounding legal environment is what gives it its powers. That legal environment doesn't operate on boolean logic, but on probability theory. Signature is just an input to that.
  - sbarre 7y ago
    Agreed, rules exist for a reason, and good changes are planned and executed safely over time.. But there's still a delta of time during which old rules continue to be applied in a manner that can feel senseless, while new processes are figured out. :-)
zabil 7y ago
It can be used to claim that I didn't sign it either. Unless it's a master forger. I could look at the document and figure out that the signature wasn't mine.
sjwright 7y ago
I have great difficulty maintaining a consistent signature, even when having to sign multiple times on the same page at the same time. A mediocre forger could probably do a better job replicating my signature than I can—if they could find a sufficiently median example of it.
Cthulhu_ 7y ago
I don't understand it either; as others pointed out as well, I can't do a consistent signature even if I tried to (I've always had trouble with writing, and I barely do anything outside of shopping lists and a paper calendar nowadays). I've always thought that as long as you can recognize your own signature and declare in a court of law, under oath, that the signature is or is not yours then it's fine. It's still not foolproof though. An ex of my GF forged her signature and took out a loan in her name. They're still on her ass about that one, despite her claims that the signature isn't hers. They're not taking it to court though, they probably don't have a case. Doesn't stop them from harassing though.
propinquity 7y ago
The Uniform Commercial Code [1] in the United States says that: > A signature may be made (i) manually or by means of a device or machine, and (ii) by the use of any name, including a trade or assumed name, or by a word, mark, or symbol executed or adopted by a person with present intention to authenticate a writing. IANAL but I would think that this program would fall under "by means of a device" and thus be considered valid. [1] https://www.law.cornell.edu/ucc/3/3-401 https://www.law.cornell.edu/ucc/3/3-401
jobseeker990 7y ago
That I can tell you in just one word ... tradition!
zelly 7y ago
Signatures being meaningful is a downright American tradition. The country was founded based on signatures. It is never going away. Crytographic protocols can be added to verify signing, but until every civilian practices perfect opsec (never gonna happen), in-person signatures in front of a notary will always be the way business is done. Better technology (this program, Photoshop, deepfakes, quantum prime factorization) may actually increase the need for in-person wet signatures.
- sterlind 7y ago
  Post-quantum digital signature algorithms based on lattices are starting to get secure, efficient and based on simple mathematical constructs. IIRC, the basic construction is you generate a lattice trapdoor matrix R, such that A*(Rt + e) ~= t. Finding an input p with small coefficients, for some t such that Ap = t reduces to one of lattice reduction problems, since it requires a finding "good" basis for the lattice (if you invert A you'll have huge coefficients, so you can't forge it. Having the trapdoor R to make p = Rt + e lets you use the trapdoor to find the preimage, and the gaussian vector e smudges it so that an attacker can't collect signatures to decipher R (this is learning with errors, another problem that reduces to lattice basis.) So the signature is easy to verify, and the trapdoor matrix is relatively small and efficient to compute (iirc a couple megs and <1s) Disclaimer: not a cryptographer, just a hobbyist.
  - zelly 7y ago
    Are there any widely analyzed implementations that I can use today? Got any links? I'm interested, but I don't think I'd understand without seeing code.
    - sterlind 7y ago
      It's a pretty bleak landscape, code-wise. The PALISADE crypto library is an implementation of many of these primitives in C++, but it will be nearly impossible to understand it without reading the papers. I recommend "Trapdoors for Lattices: Simpler, Tighter, Smaller, Faster" [0] and the many papers that build on it. That paper was fairly accessible to a layperson like myself. if you're interested you could play around with it in Sympy or Mathematica. 0. https://eprint.iacr.org/2011/501 https://eprint.iacr.org/2011/501
jve 7y ago
>Is it still legally binding? Not in the EU country I live in. 1. We have digital signatures we can use to sign documents and they are legally binding for gov. organizations and optionally every organization that accepts em. 2. For internal documents, metadata is sufficient after organization issues an order. 3. Between orgs, metadata is sufficient if you address that within contract. At least I remember it being that way few years ago. This pdf viewable signature stuff is void. Only to make feel some people better.
mercora 7y ago
i think its possible to analyze signatures in various ways that are hard to replicate. but a copy is always just a copy. What i beleive the thing here is that there are court proven ways to analyze writing styles in signatures and some more forensic methods to analyze paper and pen. as a side note: every time i get a new passport or id card i get told that my signature is not ok as it is (apparently not enough recognizable characters) but when confronted with the question how they would like me to change my signature as seen on all previous documents signed by me they shut up. I think its funny because it probably makes it even more unique.
woah 7y ago
A signature has no magic power. It's very simple. If you sign your name on a document, you are stating that you agree with the document. It doesn't matter if you use a feather pen or this guy's script. If you sign someone else's name on a document, it's obvious that you are committing fraud by impersonating them. Again, the instrument used to sign has no bearing on that. You seem to be of the opinion that since it is possible to forge a signature, it cannot be legally binding.
econcon 7y ago
Forging signature is crime, that's why signature has magical power.

shinryuu 7y ago

The question is, can you forge your own signature? If both parties agree that the document is legally binding it seems a bit unlikely that the document would fall under the forged label. Though I am not a lawyer. It's also worth noting that digital signatures throughout the european union have legal status.

toomuchtodo 7y ago
Digital signatures also have legal status in the US. Until society catches up and uses cryptographic primitives provided by a national ID smart card (such that Estonia has) for authorizing intents, this is a satisfactory method to make document execution less painful. This project is already doing the easy part (“place pretty signature picture here”). Depending on your jurisdiction and their tolerance, you could also render a true crypto signature in ascii-armored format to assist in proving legitimacy (perhaps generated as a small print signature line under the signature). Sidenote: Some transactions require a "wet" signature (as in, actual ink on actual paper from an actual pen). This doesn't get around those transactions unfortunately.
- zo1 7y ago
  All the more baffling why some countries are moving away from national identification and other digital signing initiatives to prove identity. E.g. the UK that introduced and then subsequently dismantled a national ID card and database (apparently it was a "privacy" issue for the government to have a record of citizens?). Imagine this, a first world country, living in the dark ages essentially when it comes to identity.
  - toomuchtodo 7y ago
    If you support national ID systems, please do your part to advocate for such systems whenever possible (as well as the necessary privacy and oversight controls). Progress is a function of effort. I'm working on the US side.
  - michaelt 7y ago
    > (apparently it was a "privacy" issue for the government to have a record of citizens?) That's because there's a 95% chance they'll sell it to the likes of Equifax and Experian - what minister could resist the temptation to 'make the system pay for itself' while 'reducing fraud' and 'working with the private sector' - and a 100% chance one of them will then lose it in a breach.
  - VBprogrammer 7y ago
    Just for what it's worth, a big part of the backlash against the national ID is that firstly we have a couple of decent proxies, for example driving licence and passport, and secondly we were being asked to pay for the privilege.
  - minikites 7y ago
    Many people in the USA believe a "national ID" card is the work of actual Satan: https://countdown.org/en/entries/features/national-id-cards-and-mark-beast/ https://countdown.org/en/entries/features/national-id-cards-... >These ID cards are, however, preparing the way. The more people get used to some new government regulation, restriction, or provision, the more they tolerate it and eventually just learn to live with it. What may at first seem unthinkable and raise howls of protest, later becomes accepted by a few, then many, then most. And that’s how the Antichrist and his agents will capitalize on these compulsory ID cards to prepare the world for what’s next.
    - fastball 7y ago
      I think "many" might be overselling it a bit relative to a population of ~330M.
      - 7y ago
- AnthonyMouse 7y ago
  > national ID smart card National ID systems are an incredibly bad idea. You can already get the entire authentication benefit from using decentralized ID systems (your bank authenticates you with your bank card, your employer authenticates you with your employee ID), so all a national ID adds is the ability for corporations to correlate all your different identities without your knowledge or consent, which is nothing but a privacy-invasive misfeature. Note that without a centralized ID they could still do it with your knowledge and consent by having you authenticate using multiple decentralized IDs. Centralized identity is also a huge single point of failure and compromise. It would attract far higher resources from attackers than non-monoculture ID systems do, have far reaching consequences when vulnerabilities are discovered, and take far longer to respond when changes are necessary because of the scope of use.
  - fastball 7y ago
    I think you're forgetting the part where those existing so-called "decentralized" ID systems are by-and-large using a centralized system (your SSN) which is magntitudes worse than a cryptographic card. Your bank knows that you are the same John Smith as your employer has on record, because you needed to use the same SSN for both. The status quo is that any service which requires identity validation is requiring you to provide your SSN, which in internet terms is like authenticating with only a username (no password) on all websites, AND you have to use the SAME username for every different site. Now compare that to public-key encryption. Not only is it better assuming you only have access to a single private key (because you are still authenticating with the output of the key, not the key itself as with SSN), but also because a cryptographic card could store MULTIPLE private keys, allowing you to authenticate with a different "identity" to different providers, making it impossible for them to cross-reference you in that way.
    - brewdad 7y ago
      You do need the SSN to match up with the name and other personal information like age, gender, address, etc. In that way, it's a bit like authenticating with a common username and a password that is publicly available with the username obfuscated (except in the case of data leaks).
PeterisP 7y ago
You seem to be conflating the two different, incompatible meanings of "digital signatures" here. This article is about digital signatures as in digital pictures of a signature. There's some support of them in, for example, some PDF tools. These do not have a legal status in EU. And there are "digital signatures" as in cryptographic digital verification of documents using private/public key cryptography. This is the type of digital signatures for which EU has a legal status, and in many countries a support for verifying identity - for example, I can cryptographically sign documents using the chip on my gov't ID card, and if I receive such a document, then I can securely verify the identity of the signer without needing any preexisting relationship with them. But this has nothing to do with the pictures of signatures that this article is talking about, that seems to be more like a USA thing.

jabroni_salad 7y ago

The act of marking the sig field shows your intent to bind to the contract. You can digitally sign but there are a couple extra steps to confirm the intent and identity that aren't hard but are just hard enough to make DocuSign a lot of money and leave everybody else to print/sign/scan their stuff.

arkanciscan 7y ago
So you're saying the signature itself is irrelevant? It's just an elaborate checkbox? The question then is how do you prove I was the guy who checked the box?
- xnyan 7y ago
  It’s sort of is actually. What really matters is the providence of the approval, the adult trail or whatever you want to call it. You are creating a record of when and that you agreed to something and the signature is an artifact of that agreement. A signature is somewhat harder to take them and checking a checkbox and can be somewhat more easily traced back to the signatory, so it’s probably somewhat better than a checkbox.
  - loopdoend 7y ago
    Audit trail... see also companies like Jornaya that specialize in making any form interaction auditable for consent to receive marketing.
  - oneplane 7y ago
    So in hipster terms: it's a paper blockchain that isn't immutable and has no real identity ;-)
    - edmundsauto 7y ago
      And is pretty easy to forge collisions.
    - Spivak 7y ago

fimdomeio 7y ago

In a way I don't think it's possible to forge one's own signature. What's the diference of my signature from the forgery of the signature I did myself? Signature on a piece of paper says "I read this and agree with what's written so I've put a unique piece of ink there to show my agreement" doesn't really matter what you put there if all parts agree on its validity.

arkanciscan 7y ago
But what if you aren't the one who forged your own signature? How are you going to prove that someone else scribbled something on a PDF?
- mannykannot 7y ago
  The forging of a signature has always been a possibility, which is why witnesses are required for the important stuff. On the other hand, you would be right in thinking that there is a somewhat anachronistic element of theater in having signatures on electronic documents.
  - mattkrause 7y ago
    In some ways, the theater is the point: the more elaborate the “production”, the easier it is to demonstrate that the required “meeting of the minds” took place. Someone might blithely—-or accidentally—-click continue, but you can’t really sleepwalk your way through signing a document or lining up witnesses to the signing.
  - mr_toad 7y ago
    > The forging of a signature has always been a possibility Yes, but it used to be difficult. If you can lift an image off one piece of paper and print it on another it becomes easy. It’s no different than paper currency. If it’s easy to forge, then the real money becomes worthless.

sbarre 7y ago

> Do these rules even remember the original intent? You are describing bureaucracy. There are plenty of people who work (and live) by rules that no longer make sense, but hey, they're the rules!

TeMPOraL 7y ago
Just because something can be forged doesn't mean it's useless. Signature in isolation doesn't mean anything, the surrounding legal environment is what gives it its powers. That legal environment doesn't operate on boolean logic, but on probability theory. Signature is just an input to that.
- sbarre 7y ago
  Agreed, rules exist for a reason, and good changes are planned and executed safely over time.. But there's still a delta of time during which old rules continue to be applied in a manner that can feel senseless, while new processes are figured out. :-)

zabil 7y ago

It can be used to claim that I didn't sign it either. Unless it's a master forger. I could look at the document and figure out that the signature wasn't mine.

sjwright 7y ago

I have great difficulty maintaining a consistent signature, even when having to sign multiple times on the same page at the same time. A mediocre forger could probably do a better job replicating my signature than I can—if they could find a sufficiently median example of it.

Cthulhu_ 7y ago

I don't understand it either; as others pointed out as well, I can't do a consistent signature even if I tried to (I've always had trouble with writing, and I barely do anything outside of shopping lists and a paper calendar nowadays). I've always thought that as long as you can recognize your own signature and declare in a court of law, under oath, that the signature is or is not yours then it's fine. It's still not foolproof though. An ex of my GF forged her signature and took out a loan in her name. They're still on her ass about that one, despite her claims that the signature isn't hers. They're not taking it to court though, they probably don't have a case. Doesn't stop them from harassing though.

propinquity 7y ago

The Uniform Commercial Code [1] in the United States says that: > A signature may be made (i) manually or by means of a device or machine, and (ii) by the use of any name, including a trade or assumed name, or by a word, mark, or symbol executed or adopted by a person with present intention to authenticate a writing. IANAL but I would think that this program would fall under "by means of a device" and thus be considered valid. [1] https://www.law.cornell.edu/ucc/3/3-401 https://www.law.cornell.edu/ucc/3/3-401

jobseeker990 7y ago

That I can tell you in just one word ... tradition!

zelly 7y ago

Signatures being meaningful is a downright American tradition. The country was founded based on signatures. It is never going away. Crytographic protocols can be added to verify signing, but until every civilian practices perfect opsec (never gonna happen), in-person signatures in front of a notary will always be the way business is done. Better technology (this program, Photoshop, deepfakes, quantum prime factorization) may actually increase the need for in-person wet signatures.

sterlind 7y ago
Post-quantum digital signature algorithms based on lattices are starting to get secure, efficient and based on simple mathematical constructs. IIRC, the basic construction is you generate a lattice trapdoor matrix R, such that A*(Rt + e) ~= t. Finding an input p with small coefficients, for some t such that Ap = t reduces to one of lattice reduction problems, since it requires a finding "good" basis for the lattice (if you invert A you'll have huge coefficients, so you can't forge it. Having the trapdoor R to make p = Rt + e lets you use the trapdoor to find the preimage, and the gaussian vector e smudges it so that an attacker can't collect signatures to decipher R (this is learning with errors, another problem that reduces to lattice basis.) So the signature is easy to verify, and the trapdoor matrix is relatively small and efficient to compute (iirc a couple megs and <1s) Disclaimer: not a cryptographer, just a hobbyist.
- zelly 7y ago
  Are there any widely analyzed implementations that I can use today? Got any links? I'm interested, but I don't think I'd understand without seeing code.
  - sterlind 7y ago
    It's a pretty bleak landscape, code-wise. The PALISADE crypto library is an implementation of many of these primitives in C++, but it will be nearly impossible to understand it without reading the papers. I recommend "Trapdoors for Lattices: Simpler, Tighter, Smaller, Faster" [0] and the many papers that build on it. That paper was fairly accessible to a layperson like myself. if you're interested you could play around with it in Sympy or Mathematica. 0. https://eprint.iacr.org/2011/501 https://eprint.iacr.org/2011/501

jve 7y ago

>Is it still legally binding? Not in the EU country I live in. 1. We have digital signatures we can use to sign documents and they are legally binding for gov. organizations and optionally every organization that accepts em. 2. For internal documents, metadata is sufficient after organization issues an order. 3. Between orgs, metadata is sufficient if you address that within contract. At least I remember it being that way few years ago. This pdf viewable signature stuff is void. Only to make feel some people better.

mercora 7y ago

i think its possible to analyze signatures in various ways that are hard to replicate. but a copy is always just a copy. What i beleive the thing here is that there are court proven ways to analyze writing styles in signatures and some more forensic methods to analyze paper and pen. as a side note: every time i get a new passport or id card i get told that my signature is not ok as it is (apparently not enough recognizable characters) but when confronted with the question how they would like me to change my signature as seen on all previous documents signed by me they shut up. I think its funny because it probably makes it even more unique.

woah 7y ago

A signature has no magic power. It's very simple. If you sign your name on a document, you are stating that you agree with the document. It doesn't matter if you use a feather pen or this guy's script. If you sign someone else's name on a document, it's obvious that you are committing fraud by impersonating them. Again, the instrument used to sign has no bearing on that. You seem to be of the opinion that since it is possible to forge a signature, it cannot be legally binding.

econcon 7y ago

Forging signature is crime, that's why signature has magical power.