9 ms·
Sign a PDF document client-side with no data leaving the computer
- bachmeier 5y agoA couple ways I have done this locally: (Linux) Load the PDF in xournal, click on > Tools > Image. Select a jpeg holding my signature. Change the dimensions and drag the signature around as needed. Note that you then have to export to PDF rather than saving it. (Android) Using the OneDrive app. There's a signature option in the annotate menu.
- nestorD 5y agoI am very happy with Xournal++ (which can also be used to add text to the pdf in order to fill a form for example).
- ckcheng 5y agoJust wanted to add: Xournal (not ++) can also add text and add pictures (like a pic of a signature) too. Xournal can be installed from the official Debian repository, but not Xournal++ (not yet - it's apparently being worked on). So Xournal is very convenient for filling in basic forms on Debian and is easier to install. Xournal++ could be installed on Debian by downloading a .deb, or using snap or flatpak. But not as convenient as installing Xournal via apt-get. When Xournal++ makes its way into the official Debian repository, I might switch to it. For now, I'm very happy with Xournal (the original)!
- lopatin 5y agoFYI for anyone on a Mac: The Preview App has a feature to sign any PDF or image using your trackpad.
- sp332 5y agoI've seen people complain that Preview can be inaccurate and shouldn't be trusted for important legal documents (like the ones you might want to sign). https://mobile.twitter.com/sunshowers6/status/1393005107373961217 https://mobile.twitter.com/sunshowers6/status/13930051073739... Anyone else have experience with this?
- doomrobo 5y agoYes I've had a large number of issues around annotations in Preview. I use PDFExpert for annotations now
- deleted 5y ago[deleted]
- cj 5y agoI used to have issues, but the simple fix is this: Instead of simply saving the signed PDF in preview and sending it out, export the PDF as another PDF (there’s an option to do that in the File dropdown). I’ve found that doing that fixes all comparability issues (based on signing 5-10 docs a week). Edit: Before someone tells me I should be using Acrobat, I know, but for some reason it runs painful slow on the new Apple M1’s.
- divbzero 5y agoYes, re-exporting to another PDF works reliably and also ensures you don’t leave anything editable if you’ve used text fields.
- deleted 5y ago[deleted]
- traceroute66 5y agoPreview shouldn't be trusted for legal documents ? I would call that Apple bashing nonsense. Mac, Windows, Linux, BSD ... if you're going to go signing legal documents (a) with a self-signed certificate (b) without an independently traceable timestamp .... then frankly don't expect it to hold up for long in a law court.
- sp332 5y agoHow is "the wrong checkbox being selected" related to certificates and timestamps? And the signatures we're taking about are an image of a signature, not a cryptographic one.
- s09dfhks 5y agoyou can also sign a piece of paper and hold it up to the webcam!
- bengale 5y agoI’m almost sure you can select to sign on your iPad or iPhone too and it brings up a little drawing box on them.
- andylynch 5y agoYou can. I did this the other day and it’s great
- sethhochberg 5y agoFYI, you can also use this family of features to scan entire documents: https://support.apple.com/en-us/HT209037 https://support.apple.com/en-us/HT209037 They call it "Continuity Camera", and it is probably my single favorite little feature in the Apple ecosystem. Nothing revolutionary, but just something simple done really well - and when you need it, you really need it.
- Wowfunhappy 5y agoAnd if you don't have a trackpad, it instructs you to sign a blank piece of paper and hold it up to the webcam!
- joppy 5y agoWhich usually turns out a lot better - I tried signing on a trackpad but it looked like a preschooler signing their name :P
- mtmail 5y agohttps://seedlegals.com/ https://seedlegals.com/ asked me to use my mouse for an online signature. In their FAQ they say I can't upload an existing one, quote "This is for security reasons, so that we know it is really you signing. [...], you might find it easier to perfect that sign on your phone / tablet with a touchscreen." I borrowed an iPad+Pencil from a friend and signed it with the pen, that kind of worked.
- joppy 5y agoYeah, tablet and stylus is one of the best solutions for this. Even finger-on-iPhone is pretty janky-looking.
- deleted 5y ago[deleted]
- Wowfunhappy 5y agoThis is going to sound really weird, but I was able to create a decent trackpad signature once I got into the right mental state. I held my pointer finger between my thumb and middle finger, and made myself really think of it as a pencil. I looked down at the trackpad as I wrote (rather than at the screen), and tried to visualize the trail it would leave on the surface.
- joppy 5y agoThat does sound super weird but I can see how it would work! I’d probably still prefer a stylus though :P
- tlarkworthy 5y agoI wish I had known that!
- divbzero 5y agoAnother useful trick is opening Preview’s thumbnails sidebar to edit PDFs. You can command-delete to remove PDF pages, and drag-and-drop to reorder or copy pages between different PDFs.
- izacus 5y agoPreview can't apply proper PDF signature though - while Adobe Acrobat Reader (the free one) can. Many countries can issue a digital certificate that can be used with these documents to make them legally and properly signed.
- IshKebab 5y agoMany countries? Really? I have literally never seen anyone ever use any cryptograph signature features of PDF.
- wtf_is_up 5y agoIt's pretty common in DoD space to sign PDFs using CAC (Common Access Card) PKI certs.
- jokethrowaway 5y agoThat's interesting, haven't heard of countries using pdf digital certificates. I've heard a few countries implemented certified email: anything in a certified email is considered a legal document (including a plain pdf)
- izacus 5y agoIt's not "country using signed PDFs" but "country issuing a digital certificate you can use for identity in email and document signing". Such certificate is useful for PDF signing besides other uses.
- divbzero 5y agoThe Preview app is one of the gems of macOS and a major reason I’ve stuck with Apple computers.
- jokethrowaway 5y agoI say the same about KDE's counterpart, Okular (and tons of others, Kate, klipper, kolourpaint) truly great software.
- gspr 5y agoYou can also do it locally outside the browser with well-established tools like pdftk: https://stackoverflow.com/questions/20531079/adding-an-image-to-a-pdf-with-pdftk https://stackoverflow.com/questions/20531079/adding-an-image...
- terramex 5y agoIt looks like a useful service but in case you didn't know: you can do this locally on macOS using Preview. Click on Tools->Annotate->Signature and add your own signature. You can even write it down on paper, put in front of webcam and it will recognise it and turn it to black & white. Very useful for filling out different forms.
- CyberDildonics 5y agoThis title does not make sense.
- andy0x2a 5y agoThe claim of only using software that has source code available to audit never made sense to me. Does he go through every single line of code on every single application he uses to ensure privacy? Does this mean he is an expert in the Linux kernel? And chromium, and sendmail... Like I get it's great that these are open source, but it's really not realistic for someone to audit every single line of code in every software to be guaranteed that nothing nefarious happens. If a bad actor wanted to hide an RPC request, they wouldn't label it as _sendUserDataToServer(), so it would require quite a good understanding of the call stack on the functions you are looking at. Just look at the Linux kernel, it's auditable but recently it came to light that a university had submitted nefarious code to it. Presumably that code passed code reviews, static analysis, and some sort of testing? Yet it still made it in. It's just not feasible to have 100% confidence that third party software is ensuring your privacy.
- fsflover 5y ago> but it's really not realistic for someone to audit every single line of code in every software to be guaranteed that nothing nefarious happens. This is missing the point. Having the source code decreases the chance of having malicious software by allowing random people to read the code. Anyone can raise alarm if they see anything suspicious and it's easy to check such claims.
- prepend 5y agoMy understanding is that it doesn’t answer all the risks you call out, it’s just that it is lower than the same risks and more for proprietary, non-OSS software. If components are OSS then I have an easier time auditing. And perhaps I audit one section, and trusted people audit other sections and we can all run a trivial verification program. Again, it’s not perfect, it’s just better. And it at least has the conditions for perfect review, while other methods do not.
- tlarkworthy 5y agoBy exposing your source publically it only requires one person to check to provide herd immunity. It's game theoretically superior to providing source code for one off audits on request.
- marianov 5y agoI thought this was about adding a digital signature with an x509 certificate, which has been a PITA for ages because of the PDF standard, plus browsers isolation from certificate stores, let alone hardware devices.
- maqp 5y agoIf I'm reading this right it's in-browser JS signing software. The author makes the claim that native software is hard to audit, but neglects the much bigger problem of having to verify the JS downloaded on-demand for every session. What you are served is not guaranteed to be the same as what's hosted on GitHub. Tony Arcieri explains the issues more broadly here https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto Also, Nadim Kobeissi formalized it wrt Protonmail a while ago: https://eprint.iacr.org/2018/1121.pdf https://eprint.iacr.org/2018/1121.pdf
- tlarkworthy 5y agoIn the case of sensitive pdfs, it's enough to check you network is not inexplicably in use, and I explain how to do a network audit in the notebook (yay literate programming). BTW this is "sign" as in overlay an image of your physical signature, not certify with a digital signature.
- honzajde 5y agoWhat if there is an iframe in the page, then I don't think you will see anything in network logs in devtools...
- rubyfan 5y agoThat’s what most want when they think of signing a document. There’s all sorts of technical stuff relative to PDF Signing (cryptographic) and why it matters but most people that want signed documents want to be able to say the user was presented with this document and signed it. Most also fail to understand the technical mechanisms that are important to be able to defend that a user saw what you wanted them to see and then signed it. It’d be easy to argue that the other party showed you another document, got your signature and then overlaid it onto a new document. That’s the issue with many open source signing schemes, they aren’t provable because few if any implement both cryptographic signing and signature overlay.
- itake 5y agohave there been any legal cases where the overlay was not sufficient?
- windsurfer 5y agoA free account on Adobe Acrobat online can sign PDFs, you don't need to have any kind of subscription. I'm not sure why the author felt they needed to subscribe if they were just signing PDFs. https://documentcloud.adobe.com https://documentcloud.adobe.com
- smnrchrds 5y agoI first read it as that too. But upon more careful reading, I understood what he meant is that since Adobe has bad subscription practices, he doesn't want to use any Adobe products, even free ones. This type of signing (image signature as opposed to cryptographic signature) is supported in free Adobe Reader software too, on all platforms, including Android.
- tlarkworthy 5y agoThat's a network service (I don't want Adobe reading my financial docs) and also was not around when they ripped me off in 2018.
- bachmeier 5y agoI know there's a tendency to trust Adobe because they're a large company, but how do you know what they're doing with your data? How do you know what they'll do with it at any time in the future? Is the other party okay with giving them your data? What if they decide to sell your data in the future? Sure, you could presumably try to get to the bottom of this, but it's easier to just use a local option.
- Haemm0r 5y agoFor me the title was misleading: Reading the title I tought that the article was about digitally signing documents (with your keys not your signature) :D
- thouitsme 5y agoYeah, I clicked expecting the same
- cupcake-unicorn 5y agocan anyone recommend a linux desktop app that does this? I've run into the same issue as the author. I got a lifetime for the great app https://markuphero.com https://markuphero.com but they haven't added saved signatures yet - I just write with my pen. Also although I trust them reasonably it would be nice to have something local.
- scrollaway 5y agoIt's neither free nor open source, and I really wish it were, but I can very, very strongly recommend Master PDF Editor. https://code-industry.net/masterpdfeditor/ https://code-industry.net/masterpdfeditor/ It's a very simple but full-featured PDF editor. Makes working with PDF pleasant. I didn't think it would even be possible. Inserting an image is Ctrl+I.
- nestorD 5y agoAs said in another comment, I am very happy with Xournal++. It let you add pictures (I draw my signature once in Photopea and saved the file) and text (useful to fill forms).
- ckcheng 5y agoSorry, meant to reply to you here, but did it there ( https://news.ycombinator.com/item?id=27350720 https://news.ycombinator.com/item?id=27350720 ). In short, Xournal (original, not ++) can add pictures and text too! And it's available via official Debian repository. So it's easier to install in Debian. Xournal++ is a rewrite of Xournal, and has more features, but I don't want to deal with downloading a .deb or using snap or flatpak. They're working on getting Xournal++ into official Debian repository though, but it's not there yet. Xournal (original, not ++) is quite good for filling in basic forms on Debian!
- mattmein 5y agoThe free version of Foxit PDF Reader allows you to upload a signature image and add the signature to PDF documents. There is a Linux version. https://www.foxit.com/downloads/ https://www.foxit.com/downloads/
- ilaksh 5y agoI know no one takes this seriously but you never know what will happen. Maybe someday we can replace PDFs with something open and more straightforward and practical.
- jawns 5y agoFor especially sensitive data, the assurance in this post -- that if you don't see a network request occur on save, your data remains local -- is not sufficient. Some malicious programs use techniques like delayed network requests to send data when you're not expecting it, and you basically have to audit the entire application to make sure it isn't making these covert requests.