7 ms·

If only banks knew this! They actively coax you into receiving your bank account statements as PDF, but I haven't found ANY bank which signs the PDFs (while br

If only banks knew this! They actively coax you into receiving your bank account statements as PDF, but I haven't found ANY bank which signs the PDFs (while bragging about security all the time). I wonder what happens if they lose your money due to bugs or even intentionally - will they then happily accuse you of forging the PDFs because they're unsigned? With paper that'd be not so trivial, in my country the paper often has some special format and the paper itself is of a special type, and it ages and you cannot easily guess the printer which was used. Hence I still demand all my statements on paper. Same for utility companies, health care, and other institutions which want to convert their regular physical bills to PDFs. I also demand paper because the concept of forcing the customer to manually go to N websites every month to download PDFs is idiotic. Nobody pays me for that wasted time of my life. A paper mailbox instead is a central place where I can retrieve all of my documents easily in O(1). I wonder how many decades it will take the IT industry to realize that?

yardstick 4y ago
Does your bank encrypt the PDFs? Some of mine do (Europe). Some combo of bank account and birthday to open them - they state this in the email - so trivial to open by others that know you, but not strangers. Better than nothing I guess.
- RjQoLCOSwiIKfpm 4y ago
  They refuse to send emails because "emails are insecure", you HAVE to go to their website to download the PDFs..... (And encryption is NOT a signature. Anyone who knows the password can forge an encrypted file with the same password. So the PDFs would still be worthless.)
  - s_dev 4y ago
    >And encryption is not a signature. Encryption involves using signing key and universally uniquely identifying something. That's exactly what it is. In fact encryption is even more secure than a normal written signature. I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it.
    - wongarsu 4y ago
      Encryption usually involves a signing/authentification step to prevent certain crypto attacks, but in symmetric encryption schemes those only prove that the document hasn't been modified after encryption. You still create a different document, sign it with the same password, and nobody would be able to prove that that's not the original. With asymetric encryption you have a sort of signature because only the sender has the encryption key, so forging somemthing that opens with the same decryption key is hard. But I have yet to see somebody encrypt pdfs with an asymetric method.
      - necovek 4y ago
        With "identity certificates" or "electronic IDs" used in parts of Europe, documents are indeed signed with asymmetric cryptography: a recipient of a document can't modify it and keep the signature valid.
    - pinusc 4y ago
      Are encrypted PDFs signed? AFAIK it's just symmetric encryption. You only need a password to decrypt, after all
    - Avamander 4y ago
      > That's exactly what it is. In fact encryption is even more secure than a normal written signature. No, certainly not. The biggest issue is that you're conflating a human concept of a signature and the cryptographic one. This is obvious from your second paragraph. > I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it. Cryptographically maybe, legally no. We lack crucial information about who can use your keys, there's nothing that says you can't share a random keypair that has no legal backing. We also don't know if your keys are valid at all, maybe you're underaged? Do we know if your keys were valid during the time of signing, maybe you were underaged? It's way more complex than Sign(text).
  - yardstick 4y ago
    Yeah I understand encryption isn’t an sig, just seemed like your main complaint (or second biggest complaint) was the pain in downloading them from many different places. Encrypted PDFs are one way to allow them to be emailed to you in a decently secure fashion. Sure nothing is 100% but don’t let perfect be the enemy of good. As far as signatures in PDFs goes, when have you ever needed them? What’s the real world scenario? I think most recipients would be incapable of validating the signature properly (including verifying ownership of the public key corresponding to the private key that signed it). Ie same flaws of any Cert based system.
    - RjQoLCOSwiIKfpm 4y ago
      The signature would be needed when the bank says "you have no money" even though I should have, due to their ancient COBOL systems breaking, fraud, whatever. How would I prove to a court that I do have money if I only have easily forge-able unsigned PDFs? Now before you say this is unlikely, ask yourself this: Would you lend thousands of dollars to a regular person without ANY signed document from them which says they owe you the money? No, right? Then why would I do that with a bank? If they get that much money from me they ought to at least give me a kind-of unforgeable document which says the money is mine.
judge2020 4y ago
> Nobody pays me for that wasted time of my life. Would you say the same for self checkout at the grocery store? What about burger bars where you have to put your own toppings on?
- RjQoLCOSwiIKfpm 4y ago
  Yes. They're saving money hoping that the customer does the work for free! What is your point anyway? Do you really think I should be wasting half an hour to a full hour of my life every month to download a dozen of PDFs (remember, it's not only banks which want that) so big corporations can save like $5 on paper & postage? Why would I want to work for below minimum wage for those people, for no tangible benefit to me? (Paper is as easy to process as PDFs, and IMHO in fact easier to process: You can fit multiple sheets on your desktop in parallel, you can shuffle it around, hold it next to each other for cross-referencing, you can write stuff onto it and be sure it will be readable in 10 years (might not be true for PDF annotation software!), the disk it's stored on won't die, your relatives can read it if you die, etc. If paper was a VR-product all these things would be advertised as great new VR features. In real life we get these 3D-features for free but their advantages are completely ignored when forcing the usage of computers for the sake of it.)
  - muhehe 4y ago
    > so big corporations can save like $5 on paper & postage? At their scale it's much. I honestly don't care about their costs, but at their scale that's tons of paper and gas that's totally wasted. I don't know which country you're from, but all my bank statements, utility invoice etc go to my email, so there is no need to log anywhere. I'm not sure about others right now, but utilities are definitely signed. Maybe you could talk to your bank/... about it.
    - RjQoLCOSwiIKfpm 4y ago
      > At their scale it's much. At their scale it is replaceable: They earn money to do their duties, if they cost a bit more they bill the customers a bit more so they get it back. The time of my life is NOT replaceable. I do not get it back EVER. And they very likely don't give a damn about their customers, it doesn't matter to them if some cronjob delivers PDFs or another cronjob prints letters - at the end of the day they just want to go home. I do CARE about living, it gravely matters to me how much of my life I have available for myself. > tons of paper and gas that's totally wasted. It's not wasted: It fulfilled it's purpose of delivering information to me in a convenient fashion. And once I'm done with it, it goes into the paper bin and gets recycled. > I don't know which country you're from, but all my bank statements, utility invoice etc go to my email, so there is no need to log anywhere. I'm not sure about others right now, but utilities are definitely signed. Every company here has a different method. Websites, emails which link to websites, emails which are the invoice, emails which have an attachement that is the invoice. It is impossible to cleanly integrate this into one workflow. A plain old regular paper mailbox however already is a clean, integrated workflow which ships unified pieces of paper which all have the same size and are able to be put into the same kind of folders thus. Hence optimizing this to be more convenient for companies means taking away individual lifetime which matters to individuals for the sake of enriching entities which do not care about the money they saved, it's just a number in some database for them. > Maybe you could talk to your bank/... about it. Do you seriously believe they will do anything? Whenever I interact with those kind of people, I rarely get an answer ever, and that's about things which are part of their daily duties. If you go to them expecting them to actually do something out of their ordinary - good luck. It will get ignored with a 99% probability. And even if one of them does something: Then the other dozen companies I have to deal with will not do anything. So paper has to stay anyway. I'm happy with it. It's convenient, it's super standardized, and it just works.
necovek 4y ago
I'd rather go to 5 web sites and download PDFs than open 5 envelopes, throw them away, and sort out different paper documents into different binders or folders: nobody is paying me for the wasted time of my life to do that either :) How do you organise your paper documents?
- RjQoLCOSwiIKfpm 4y ago
  This can easily be streamlined to consume little time by: - Realizing that whenever you need to extract some old document in the future for reference / proof, you'll likely have a date range when it happened to go looking for it. And needing something old happens rarely enough that the overhead of searching for it can be neglected, so you'll layout your binders to make putting things away fast, not searching things. And the older things become the less likely it is that you'll ever need them again. So sorting by date is important. - Thus realizing that any finished documents can go to a SINGLE binder which is sorted by date, you don't need a separate one for healthcare, utilities, whatever. You don't even need registers in the binder, just flat date sorting. - Therefore, you'll only be having 3 binders: "ToDo", "Done" and "Constantly needed" (the latter is for contracts for example). Sort the contents of "ToDo" and "Done" by date. Adding new paper will be quick because new stuff arrives close to the most recent date so you don't have to search a lot for the place to insert it at. AND: Make sure to mark the date on every document with a highlighter of always the same color so you can easily spot the dates when inserting. TL;DR: Most documents will go to a single or two sorted-by-date places, just like your email inbox. This makes adding things fast.
  - necovek 4y ago
    Thanks for sharing your approach: I do like the fact you are optimizing for "putting away things". The amount of documentation you have (and have to go back to) is probably on an entirely different scale to what I am personally dealing with: this would never work for me, since just a date would make finding stuff almost impossible.
    - RjQoLCOSwiIKfpm 4y ago
MrGilbert 4y ago
I'm really glad I get most of my documents digital right now. I can download them, sort them into folders on my home server, and I'm happy as I could be. If I need a file or invoice, I simply open my server's folder structure and grab the one I need.
superphil0 4y ago
Hi, Philipp here (one of the creators) Haha, this is so funny, this is one of the BIG reasons why we built this in the first place
- RjQoLCOSwiIKfpm 4y ago
  :) Do they pay you for this?
  - superphil0 4y ago
    No, but would be cool if they used it
    - RjQoLCOSwiIKfpm 4y ago
      I would advise you to deliver your incredible goodwill to a non-profit organization which actually values it instead of working on something for banks :) The rotten, soulless entities that is banks do not deserve ANY free work. They don't care about you, they won't value you work, they won't give anything back. They'll use it to maximize their profits at best. But most likely, they won't do anything: With absolute certainty, they KNOW that PDFs can be signed. They have to deal with cryptography anyway, and have security consulting. They very likely intentionally decided to not sign PDFs anyway just because they can get away with it without getting sued, and save money by that.
      - philihp 4y ago
        They very likely hired an external firm to write their PDF export, and the person implementing it was just trying to finish the contract on time and to spec. The overhead of maintaining a properly secured PKI key and implementing signing of generated PDFs with it is nonzero. Banks aren't always rotten and soulless, they are cold and lazy machines that do the bare minimum that their customers ask. This project is great, let's spread awareness that PDFs _can_ keep an internal digital signature and maybe someday their customers will demand it.
vbezhenar 4y ago
I think that a big missing elephant is a tool which provides authenticated download. What I mean is the following: Let's say that I'm downloading PDF from mybank.com. Browser establishes TLS connection to the mybank.com, sends request, receives response PDF and then does something with response. This TLS connection could be serialized as it is with accompanied ephemereal keys. Those bytes include remote peer X509 certificate signed by digicert and the whole exchange is further cryptographically signed with corresponding key. So basically you already have cryptographically signed PDF from your bank. You just don't have tools to save or verify this signature. And juridical framework to further act on those artifacts. But tech is deployed for 30+ years already.
- detaro 4y ago
  No, what's tied to the certificate is only the identity of the endpoints, not the content being transmitted (since that's only protected by a symmetric key both sides know), so you can forge a "recording" of a HTTPS session for any file you want. There have been proposals to extend TLS to have this capability, but to my knowledge none are really standardized or used anywhere.
  - vbezhenar 4y ago
    Thanks, this is unfortunate.
  - necovek 4y ago
    Wouldn't an ability to "forge a recording of a(n) HTTP session for any file you want" mean that you can implement a transparent HTTPS/TLS proxy that allows MITM attacks? To deliver any file over TLS, you need access to the private key part of the TLS certificate, and to decrypt it, you need the public part. Having a recording of unencrypted raw TLS session along with the public key part would allow decrypting the stream later, while making it impossible to forge any data not coming from the identity controling those private keys. For proper verifiability in the future, you'd want more details from the certificate and CAs (like verifiable way to ensure certificate was not revoked at the time of download), but there is already an asymmetric encryption happening at the TLS level. Now, you can still forge some parts by omission: if you've got streamable data (requiring no random seeks), you can cut off parts of documents while maintaining encryption: you still can't modify it otherwise. What am I missing in your claim of forging a "recording" of an HTTPS session?
pge 4y ago
In the fraud case at tech company NS8[1] (for which the CEO was recently sentenced to prison), the CEO apparently edited PDF bank statements before sharing them with his CFO. I think most people naturally assume that a PDF is unalterable so a PDF document. While not commonly exploited, that assumption is a big security gap. We need a way to sign PDFs to ensure their authenticity. [1]https://www.sec.gov/litigation/complaints/2020/comp24905.pdf https://www.sec.gov/litigation/complaints/2020/comp24905.pdf
- terom 4y ago
  A way to sign PDFs would be great, but then we also need a way to verify the signatures. And verify that it was signed by whoever issued the document, not someone else who tampered with it. Not really sure what the state of the art there actually is. Pessimistically I figure we're still at the stage where websites would put an image of a lock with a green checkmark on their website to make it look secure - i.e. really only just for show.
  - superphil0 4y ago
    https://ec.europa.eu/digital-building-blocks/DSS/webapp-demo/validation https://ec.europa.eu/digital-building-blocks/DSS/webapp-demo...
Calzifer 4y ago
> I wonder what happens if they lose your money due to bugs or even intentionally - will they then happily accuse you of forging the PDFs because they're unsigned? > With paper that'd be not so trivial, in my country the paper often has some special format and the paper itself is of a special type, and it ages and you cannot easily guess the printer which was used. Read a similar discussion recently. Even with paper you can prove your account balance at day X but if your bank lose your money at day X + n and you want it back they could still claim you withdraw all since day X and had an empty account at day of lose.
- RjQoLCOSwiIKfpm 4y ago
  Fine, so the paper protects me for bogus withdrawals during a number of X days, it just doesn't protect me for the additional n. The PDFs protect me for 0 days because they can claim I've faked them right from the beginning. I'll take the paper :)
sowbug 4y ago
I'd be satisfied if my bank's web developers learned about the Content-Disposition header and set the filename reasonably. Nothing quite like downloading dozens of statements for various accounts at the end of the year and then having to rename dozens of files named "download.php (1-30).pdf" in your downloads folder. With a single line of code, each of those could be "institution-acct-year-month-day.pdf" instead. It would significantly reduce the toil that punishes diligent customers.
Avamander 4y ago
It's not only PDF's, email sent by banks should be both DKIM and S/MIME signed but we barely get the former.
emodendroket 4y ago
My paper statements do not come on a special paper either.
jve 4y ago
Hello from 3rd world country. It feels weird to read this and just download bank statement digitally signed as .pdf.asice format. Well, I can also use my id card to login to bank. Many people here don't realize how things are very well right here, at some very small country.
- xyzelement 4y ago
  Sveiks :) It's easy to get things perfectly when everything is new and the audience is small.
slowhand09 4y ago
̶I̶f̶ ̶o̶n̶l̶y̶ ̶b̶a̶n̶k̶s̶ ̶k̶n̶e̶w̶ ̶t̶h̶i̶s̶ The one secret Banks hate! FTFY
deleted 4y ago
[deleted]

yardstick 4y ago

Does your bank encrypt the PDFs? Some of mine do (Europe). Some combo of bank account and birthday to open them - they state this in the email - so trivial to open by others that know you, but not strangers. Better than nothing I guess.

RjQoLCOSwiIKfpm 4y ago
They refuse to send emails because "emails are insecure", you HAVE to go to their website to download the PDFs..... (And encryption is NOT a signature. Anyone who knows the password can forge an encrypted file with the same password. So the PDFs would still be worthless.)
- s_dev 4y ago
  >And encryption is not a signature. Encryption involves using signing key and universally uniquely identifying something. That's exactly what it is. In fact encryption is even more secure than a normal written signature. I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it.
  - wongarsu 4y ago
    Encryption usually involves a signing/authentification step to prevent certain crypto attacks, but in symmetric encryption schemes those only prove that the document hasn't been modified after encryption. You still create a different document, sign it with the same password, and nobody would be able to prove that that's not the original. With asymetric encryption you have a sort of signature because only the sender has the encryption key, so forging somemthing that opens with the same decryption key is hard. But I have yet to see somebody encrypt pdfs with an asymetric method.
    - necovek 4y ago
      With "identity certificates" or "electronic IDs" used in parts of Europe, documents are indeed signed with asymmetric cryptography: a recipient of a document can't modify it and keep the signature valid.
  - pinusc 4y ago
    Are encrypted PDFs signed? AFAIK it's just symmetric encryption. You only need a password to decrypt, after all
  - Avamander 4y ago
    > That's exactly what it is. In fact encryption is even more secure than a normal written signature. No, certainly not. The biggest issue is that you're conflating a human concept of a signature and the cryptographic one. This is obvious from your second paragraph. > I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it. Cryptographically maybe, legally no. We lack crucial information about who can use your keys, there's nothing that says you can't share a random keypair that has no legal backing. We also don't know if your keys are valid at all, maybe you're underaged? Do we know if your keys were valid during the time of signing, maybe you were underaged? It's way more complex than Sign(text).
- yardstick 4y ago
  Yeah I understand encryption isn’t an sig, just seemed like your main complaint (or second biggest complaint) was the pain in downloading them from many different places. Encrypted PDFs are one way to allow them to be emailed to you in a decently secure fashion. Sure nothing is 100% but don’t let perfect be the enemy of good. As far as signatures in PDFs goes, when have you ever needed them? What’s the real world scenario? I think most recipients would be incapable of validating the signature properly (including verifying ownership of the public key corresponding to the private key that signed it). Ie same flaws of any Cert based system.
  - RjQoLCOSwiIKfpm 4y ago
    The signature would be needed when the bank says "you have no money" even though I should have, due to their ancient COBOL systems breaking, fraud, whatever. How would I prove to a court that I do have money if I only have easily forge-able unsigned PDFs? Now before you say this is unlikely, ask yourself this: Would you lend thousands of dollars to a regular person without ANY signed document from them which says they owe you the money? No, right? Then why would I do that with a bank? If they get that much money from me they ought to at least give me a kind-of unforgeable document which says the money is mine.

judge2020 4y ago

> Nobody pays me for that wasted time of my life. Would you say the same for self checkout at the grocery store? What about burger bars where you have to put your own toppings on?

RjQoLCOSwiIKfpm 4y ago
Yes. They're saving money hoping that the customer does the work for free! What is your point anyway? Do you really think I should be wasting half an hour to a full hour of my life every month to download a dozen of PDFs (remember, it's not only banks which want that) so big corporations can save like $5 on paper & postage? Why would I want to work for below minimum wage for those people, for no tangible benefit to me? (Paper is as easy to process as PDFs, and IMHO in fact easier to process: You can fit multiple sheets on your desktop in parallel, you can shuffle it around, hold it next to each other for cross-referencing, you can write stuff onto it and be sure it will be readable in 10 years (might not be true for PDF annotation software!), the disk it's stored on won't die, your relatives can read it if you die, etc. If paper was a VR-product all these things would be advertised as great new VR features. In real life we get these 3D-features for free but their advantages are completely ignored when forcing the usage of computers for the sake of it.)
- muhehe 4y ago
  > so big corporations can save like $5 on paper & postage? At their scale it's much. I honestly don't care about their costs, but at their scale that's tons of paper and gas that's totally wasted. I don't know which country you're from, but all my bank statements, utility invoice etc go to my email, so there is no need to log anywhere. I'm not sure about others right now, but utilities are definitely signed. Maybe you could talk to your bank/... about it.
  - RjQoLCOSwiIKfpm 4y ago
    > At their scale it's much. At their scale it is replaceable: They earn money to do their duties, if they cost a bit more they bill the customers a bit more so they get it back. The time of my life is NOT replaceable. I do not get it back EVER. And they very likely don't give a damn about their customers, it doesn't matter to them if some cronjob delivers PDFs or another cronjob prints letters - at the end of the day they just want to go home. I do CARE about living, it gravely matters to me how much of my life I have available for myself. > tons of paper and gas that's totally wasted. It's not wasted: It fulfilled it's purpose of delivering information to me in a convenient fashion. And once I'm done with it, it goes into the paper bin and gets recycled. > I don't know which country you're from, but all my bank statements, utility invoice etc go to my email, so there is no need to log anywhere. I'm not sure about others right now, but utilities are definitely signed. Every company here has a different method. Websites, emails which link to websites, emails which are the invoice, emails which have an attachement that is the invoice. It is impossible to cleanly integrate this into one workflow. A plain old regular paper mailbox however already is a clean, integrated workflow which ships unified pieces of paper which all have the same size and are able to be put into the same kind of folders thus. Hence optimizing this to be more convenient for companies means taking away individual lifetime which matters to individuals for the sake of enriching entities which do not care about the money they saved, it's just a number in some database for them. > Maybe you could talk to your bank/... about it. Do you seriously believe they will do anything? Whenever I interact with those kind of people, I rarely get an answer ever, and that's about things which are part of their daily duties. If you go to them expecting them to actually do something out of their ordinary - good luck. It will get ignored with a 99% probability. And even if one of them does something: Then the other dozen companies I have to deal with will not do anything. So paper has to stay anyway. I'm happy with it. It's convenient, it's super standardized, and it just works.

necovek 4y ago

I'd rather go to 5 web sites and download PDFs than open 5 envelopes, throw them away, and sort out different paper documents into different binders or folders: nobody is paying me for the wasted time of my life to do that either :) How do you organise your paper documents?

RjQoLCOSwiIKfpm 4y ago
This can easily be streamlined to consume little time by: - Realizing that whenever you need to extract some old document in the future for reference / proof, you'll likely have a date range when it happened to go looking for it. And needing something old happens rarely enough that the overhead of searching for it can be neglected, so you'll layout your binders to make putting things away fast, not searching things. And the older things become the less likely it is that you'll ever need them again. So sorting by date is important. - Thus realizing that any finished documents can go to a SINGLE binder which is sorted by date, you don't need a separate one for healthcare, utilities, whatever. You don't even need registers in the binder, just flat date sorting. - Therefore, you'll only be having 3 binders: "ToDo", "Done" and "Constantly needed" (the latter is for contracts for example). Sort the contents of "ToDo" and "Done" by date. Adding new paper will be quick because new stuff arrives close to the most recent date so you don't have to search a lot for the place to insert it at. AND: Make sure to mark the date on every document with a highlighter of always the same color so you can easily spot the dates when inserting. TL;DR: Most documents will go to a single or two sorted-by-date places, just like your email inbox. This makes adding things fast.
- necovek 4y ago
  Thanks for sharing your approach: I do like the fact you are optimizing for "putting away things". The amount of documentation you have (and have to go back to) is probably on an entirely different scale to what I am personally dealing with: this would never work for me, since just a date would make finding stuff almost impossible.
  - RjQoLCOSwiIKfpm 4y ago

MrGilbert 4y ago

I'm really glad I get most of my documents digital right now. I can download them, sort them into folders on my home server, and I'm happy as I could be. If I need a file or invoice, I simply open my server's folder structure and grab the one I need.

superphil0 4y ago

Hi, Philipp here (one of the creators) Haha, this is so funny, this is one of the BIG reasons why we built this in the first place

RjQoLCOSwiIKfpm 4y ago
:) Do they pay you for this?
- superphil0 4y ago
  No, but would be cool if they used it
  - RjQoLCOSwiIKfpm 4y ago
    I would advise you to deliver your incredible goodwill to a non-profit organization which actually values it instead of working on something for banks :) The rotten, soulless entities that is banks do not deserve ANY free work. They don't care about you, they won't value you work, they won't give anything back. They'll use it to maximize their profits at best. But most likely, they won't do anything: With absolute certainty, they KNOW that PDFs can be signed. They have to deal with cryptography anyway, and have security consulting. They very likely intentionally decided to not sign PDFs anyway just because they can get away with it without getting sued, and save money by that.
    - philihp 4y ago
      They very likely hired an external firm to write their PDF export, and the person implementing it was just trying to finish the contract on time and to spec. The overhead of maintaining a properly secured PKI key and implementing signing of generated PDFs with it is nonzero. Banks aren't always rotten and soulless, they are cold and lazy machines that do the bare minimum that their customers ask. This project is great, let's spread awareness that PDFs _can_ keep an internal digital signature and maybe someday their customers will demand it.

vbezhenar 4y ago

I think that a big missing elephant is a tool which provides authenticated download. What I mean is the following: Let's say that I'm downloading PDF from mybank.com. Browser establishes TLS connection to the mybank.com, sends request, receives response PDF and then does something with response. This TLS connection could be serialized as it is with accompanied ephemereal keys. Those bytes include remote peer X509 certificate signed by digicert and the whole exchange is further cryptographically signed with corresponding key. So basically you already have cryptographically signed PDF from your bank. You just don't have tools to save or verify this signature. And juridical framework to further act on those artifacts. But tech is deployed for 30+ years already.

detaro 4y ago
No, what's tied to the certificate is only the identity of the endpoints, not the content being transmitted (since that's only protected by a symmetric key both sides know), so you can forge a "recording" of a HTTPS session for any file you want. There have been proposals to extend TLS to have this capability, but to my knowledge none are really standardized or used anywhere.
- vbezhenar 4y ago
  Thanks, this is unfortunate.
- necovek 4y ago
  Wouldn't an ability to "forge a recording of a(n) HTTP session for any file you want" mean that you can implement a transparent HTTPS/TLS proxy that allows MITM attacks? To deliver any file over TLS, you need access to the private key part of the TLS certificate, and to decrypt it, you need the public part. Having a recording of unencrypted raw TLS session along with the public key part would allow decrypting the stream later, while making it impossible to forge any data not coming from the identity controling those private keys. For proper verifiability in the future, you'd want more details from the certificate and CAs (like verifiable way to ensure certificate was not revoked at the time of download), but there is already an asymmetric encryption happening at the TLS level. Now, you can still forge some parts by omission: if you've got streamable data (requiring no random seeks), you can cut off parts of documents while maintaining encryption: you still can't modify it otherwise. What am I missing in your claim of forging a "recording" of an HTTPS session?

pge 4y ago

In the fraud case at tech company NS8[1] (for which the CEO was recently sentenced to prison), the CEO apparently edited PDF bank statements before sharing them with his CFO. I think most people naturally assume that a PDF is unalterable so a PDF document. While not commonly exploited, that assumption is a big security gap. We need a way to sign PDFs to ensure their authenticity. [1]https://www.sec.gov/litigation/complaints/2020/comp24905.pdf https://www.sec.gov/litigation/complaints/2020/comp24905.pdf

terom 4y ago
A way to sign PDFs would be great, but then we also need a way to verify the signatures. And verify that it was signed by whoever issued the document, not someone else who tampered with it. Not really sure what the state of the art there actually is. Pessimistically I figure we're still at the stage where websites would put an image of a lock with a green checkmark on their website to make it look secure - i.e. really only just for show.
- superphil0 4y ago
  https://ec.europa.eu/digital-building-blocks/DSS/webapp-demo/validation https://ec.europa.eu/digital-building-blocks/DSS/webapp-demo...

Calzifer 4y ago

> I wonder what happens if they lose your money due to bugs or even intentionally - will they then happily accuse you of forging the PDFs because they're unsigned? > With paper that'd be not so trivial, in my country the paper often has some special format and the paper itself is of a special type, and it ages and you cannot easily guess the printer which was used. Read a similar discussion recently. Even with paper you can prove your account balance at day X but if your bank lose your money at day X + n and you want it back they could still claim you withdraw all since day X and had an empty account at day of lose.

RjQoLCOSwiIKfpm 4y ago
Fine, so the paper protects me for bogus withdrawals during a number of X days, it just doesn't protect me for the additional n. The PDFs protect me for 0 days because they can claim I've faked them right from the beginning. I'll take the paper :)

sowbug 4y ago

I'd be satisfied if my bank's web developers learned about the Content-Disposition header and set the filename reasonably. Nothing quite like downloading dozens of statements for various accounts at the end of the year and then having to rename dozens of files named "download.php (1-30).pdf" in your downloads folder. With a single line of code, each of those could be "institution-acct-year-month-day.pdf" instead. It would significantly reduce the toil that punishes diligent customers.

Avamander 4y ago

It's not only PDF's, email sent by banks should be both DKIM and S/MIME signed but we barely get the former.

emodendroket 4y ago

My paper statements do not come on a special paper either.

jve 4y ago

Hello from 3rd world country. It feels weird to read this and just download bank statement digitally signed as .pdf.asice format. Well, I can also use my id card to login to bank. Many people here don't realize how things are very well right here, at some very small country.

xyzelement 4y ago
Sveiks :) It's easy to get things perfectly when everything is new and the audience is small.

slowhand09 4y ago

̶I̶f̶ ̶o̶n̶l̶y̶ ̶b̶a̶n̶k̶s̶ ̶k̶n̶e̶w̶ ̶t̶h̶i̶s̶ The one secret Banks hate! FTFY

deleted 4y ago

[deleted]