5 ms·

Does your bank encrypt the PDFs? Some of mine do (Europe). Some combo of bank account and birthday to open them - they state this in the email - so trivial to o

Does your bank encrypt the PDFs? Some of mine do (Europe). Some combo of bank account and birthday to open them - they state this in the email - so trivial to open by others that know you, but not strangers. Better than nothing I guess.

RjQoLCOSwiIKfpm 4y ago
They refuse to send emails because "emails are insecure", you HAVE to go to their website to download the PDFs..... (And encryption is NOT a signature. Anyone who knows the password can forge an encrypted file with the same password. So the PDFs would still be worthless.)
- s_dev 4y ago
  >And encryption is not a signature. Encryption involves using signing key and universally uniquely identifying something. That's exactly what it is. In fact encryption is even more secure than a normal written signature. I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it.
  - wongarsu 4y ago
    Encryption usually involves a signing/authentification step to prevent certain crypto attacks, but in symmetric encryption schemes those only prove that the document hasn't been modified after encryption. You still create a different document, sign it with the same password, and nobody would be able to prove that that's not the original. With asymetric encryption you have a sort of signature because only the sender has the encryption key, so forging somemthing that opens with the same decryption key is hard. But I have yet to see somebody encrypt pdfs with an asymetric method.
    - necovek 4y ago
      With "identity certificates" or "electronic IDs" used in parts of Europe, documents are indeed signed with asymmetric cryptography: a recipient of a document can't modify it and keep the signature valid.
  - pinusc 4y ago
    Are encrypted PDFs signed? AFAIK it's just symmetric encryption. You only need a password to decrypt, after all
  - Avamander 4y ago
    > That's exactly what it is. In fact encryption is even more secure than a normal written signature. No, certainly not. The biggest issue is that you're conflating a human concept of a signature and the cryptographic one. This is obvious from your second paragraph. > I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it. Cryptographically maybe, legally no. We lack crucial information about who can use your keys, there's nothing that says you can't share a random keypair that has no legal backing. We also don't know if your keys are valid at all, maybe you're underaged? Do we know if your keys were valid during the time of signing, maybe you were underaged? It's way more complex than Sign(text).
- yardstick 4y ago
  Yeah I understand encryption isn’t an sig, just seemed like your main complaint (or second biggest complaint) was the pain in downloading them from many different places. Encrypted PDFs are one way to allow them to be emailed to you in a decently secure fashion. Sure nothing is 100% but don’t let perfect be the enemy of good. As far as signatures in PDFs goes, when have you ever needed them? What’s the real world scenario? I think most recipients would be incapable of validating the signature properly (including verifying ownership of the public key corresponding to the private key that signed it). Ie same flaws of any Cert based system.
  - RjQoLCOSwiIKfpm 4y ago
    The signature would be needed when the bank says "you have no money" even though I should have, due to their ancient COBOL systems breaking, fraud, whatever. How would I prove to a court that I do have money if I only have easily forge-able unsigned PDFs? Now before you say this is unlikely, ask yourself this: Would you lend thousands of dollars to a regular person without ANY signed document from them which says they owe you the money? No, right? Then why would I do that with a bank? If they get that much money from me they ought to at least give me a kind-of unforgeable document which says the money is mine.

RjQoLCOSwiIKfpm 4y ago

They refuse to send emails because "emails are insecure", you HAVE to go to their website to download the PDFs..... (And encryption is NOT a signature. Anyone who knows the password can forge an encrypted file with the same password. So the PDFs would still be worthless.)

s_dev 4y ago
>And encryption is not a signature. Encryption involves using signing key and universally uniquely identifying something. That's exactly what it is. In fact encryption is even more secure than a normal written signature. I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it.
- wongarsu 4y ago
  Encryption usually involves a signing/authentification step to prevent certain crypto attacks, but in symmetric encryption schemes those only prove that the document hasn't been modified after encryption. You still create a different document, sign it with the same password, and nobody would be able to prove that that's not the original. With asymetric encryption you have a sort of signature because only the sender has the encryption key, so forging somemthing that opens with the same decryption key is hard. But I have yet to see somebody encrypt pdfs with an asymetric method.
  - necovek 4y ago
    With "identity certificates" or "electronic IDs" used in parts of Europe, documents are indeed signed with asymmetric cryptography: a recipient of a document can't modify it and keep the signature valid.
- pinusc 4y ago
  Are encrypted PDFs signed? AFAIK it's just symmetric encryption. You only need a password to decrypt, after all
- Avamander 4y ago
  > That's exactly what it is. In fact encryption is even more secure than a normal written signature. No, certainly not. The biggest issue is that you're conflating a human concept of a signature and the cryptographic one. This is obvious from your second paragraph. > I can sign a piece of text put it here -- sign it with my private key -- put it on HN with my public key and everyone can be sure I wrote it. Cryptographically maybe, legally no. We lack crucial information about who can use your keys, there's nothing that says you can't share a random keypair that has no legal backing. We also don't know if your keys are valid at all, maybe you're underaged? Do we know if your keys were valid during the time of signing, maybe you were underaged? It's way more complex than Sign(text).
yardstick 4y ago
Yeah I understand encryption isn’t an sig, just seemed like your main complaint (or second biggest complaint) was the pain in downloading them from many different places. Encrypted PDFs are one way to allow them to be emailed to you in a decently secure fashion. Sure nothing is 100% but don’t let perfect be the enemy of good. As far as signatures in PDFs goes, when have you ever needed them? What’s the real world scenario? I think most recipients would be incapable of validating the signature properly (including verifying ownership of the public key corresponding to the private key that signed it). Ie same flaws of any Cert based system.
- RjQoLCOSwiIKfpm 4y ago
  The signature would be needed when the bank says "you have no money" even though I should have, due to their ancient COBOL systems breaking, fraud, whatever. How would I prove to a court that I do have money if I only have easily forge-able unsigned PDFs? Now before you say this is unlikely, ask yourself this: Would you lend thousands of dollars to a regular person without ANY signed document from them which says they owe you the money? No, right? Then why would I do that with a bank? If they get that much money from me they ought to at least give me a kind-of unforgeable document which says the money is mine.