Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

gitlab.com

Post reply on HN
Print view View original

111–120 of 191 posts

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#111

Post by brewdad »

fastball wrote: post #91
AnthonyMouse wrote: post #82

Earlier quoted context omitted.

> national ID smart card National ID systems are an incredibly bad idea. You can already get the entire authentication benefit from using decentralized ID systems (your bank authenticates you with your bank card, your employer authenticates you with your employee ID), so all a national ID adds is the ability for corporations to correlate all your different identities without your knowledge or consent, which is nothin…

I think you're forgetting the part where those existing so-called "decentralized" ID systems are by-and-large using a centralized system (your SSN) which is magntitudes worse than a cryptographic card. Your bank knows that you are the same John Smith as your employer has on record, because you needed to use the same SSN for both. The status quo is that any service which requires identity validation is requiring you t…

You do need the SSN to match up with the name and other personal information like age, gender, address, etc. In that way, it's a bit like authenticating with a common username and a password that is publicly available with the username obfuscated (except in the case of data leaks).

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#112

Post by toomuchtodo »

brewdad wrote: post #111
fastball wrote: post #91

Earlier quoted context omitted.

I think you're forgetting the part where those existing so-called "decentralized" ID systems are by-and-large using a centralized system (your SSN) which is magntitudes worse than a cryptographic card. Your bank knows that you are the same John Smith as your employer has on record, because you needed to use the same SSN for both. The status quo is that any service which requires identity validation is requiring you t…

You do need the SSN to match up with the name and other personal information like age, gender, address, etc. In that way, it's a bit like authenticating with a common username and a password that is publicly available with the username obfuscated (except in the case of data leaks).

Instead of a unique ID like a SSN, we should be using an identity provider to support such use cases. Imagine instead that you would authenticate with https://login.gov (ideally with your credentials and a hardware 2FA device), which would then attest to whatever service you were logging in to that you are you.

You can't rotate a social security number with reasonable effort, and we can longer treat it as a secret, because it isn't one. It's time to move past it as an identifier.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#113

Post by saagarjha »

giancarlostoro wrote: post #21

(HBO) Silicon Valley Reference: That looks like the Gavin Belson signature. This is kind of useful though, I was in shock and horror when I realized one PDF my Adobe Fill & Sign app couldnt... fill and sign, an actual IRS tax form. I don't know why they let you fill most of it out but force you to sign the damn thing. What's even more confusing is other forms don't restrict this, it's just one of the ones I tried (ca…

I think there's a much less niche thing it might be referencing.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#114

Post by mindslight »

JorgeGT wrote: post #35
Xelbair wrote: post #31

Earlier quoted context omitted.

thankfully over here they have to honor digital signatures, no exceptions.

Yep, and here the government even provides you with a free qualified certificate to sign.

That doesn't work for the US, because any constraints on use are politically unpalatable. Any capability that the government creates thus turns into a security vulnerability to be exploited by business.

For example, even just assigning everybody unique identifiers (social security number, drivers' license number) has allowed businesses to demand these identifiers to track customers in privately-held surveillance databases. This system has already grown out of control with little sign of stopping.

A "secure" e-signature token would lead to even more businesses demanding your "identity". Imagine having to pay twice as much for groceries for wanting to keep your purchases personal!

I'd much rather suffer the small work of (print, sign, scan, cache, burn) until I see some reigning in of private surveillance databases.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#116

Post by minikites »

fastball wrote: post #94
minikites wrote: post #72

Earlier quoted context omitted.

Many people in the USA believe a "national ID" card is the work of actual Satan: https://countdown.org/en/entries/features/national-id-cards-... >These ID cards are, however, preparing the way. The more people get used to some new government regulation, restriction, or provision, the more they tolerate it and eventually just learn to live with it. What may at first seem unthinkable and raise howls of protest, later b…

I think "many" might be overselling it a bit relative to a population of ~330M.

People who believe that have incredible influence in our flawed political structure.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#117

Post by edmundsauto »

oneplane wrote: post #49
xnyan wrote: post #27

Earlier quoted context omitted.

It’s sort of is actually. What really matters is the providence of the approval, the adult trail or whatever you want to call it. You are creating a record of when and that you agreed to something and the signature is an artifact of that agreement. A signature is somewhat harder to take them and checking a checkbox and can be somewhat more easily traced back to the signatory, so it’s probably somewhat better than a c…

So in hipster terms: it's a paper blockchain that isn't immutable and has no real identity ;-)

And is pretty easy to forge collisions.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#118

Post by Spivak »

oneplane wrote: post #49
xnyan wrote: post #27

Earlier quoted context omitted.

It’s sort of is actually. What really matters is the providence of the approval, the adult trail or whatever you want to call it. You are creating a record of when and that you agreed to something and the signature is an artifact of that agreement. A signature is somewhat harder to take them and checking a checkbox and can be somewhat more easily traced back to the signatory, so it’s probably somewhat better than a c…

So in hipster terms: it's a paper blockchain that isn't immutable and has no real identity ;-)

I mean it's just a paper record. It's existence alone doesn't necessarily prove anything on its own. It's when you're making a case to a judge that you didn't buy 1700 rolls of toilet paper they can say bring it out and say "Yes you did and we have your signature."

You're free to counter and say it's a forgery just as you would be to counter and say someone stole your private key. But the point of a signature in particular is that it's supposed to signal considered intent rather than mindlessly checking a box or being rushed and saying "sure sure whatever."

We pop up dialogs to ask users for confirmation before doing dangerous actions. What's wrong with the paper equivalent?

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#119

Post by tathougies »

arkanciscan wrote: post #23

Is anyone aware of an actual court case where the validity of a DocuSign doc was held up?

DocuSign is valid by statute: https://en.wikipedia.org/wiki/Electronic_Signatures_in_Globa...

Their security implementation or the authenticity mechanism they have for recording is not even really up for scrutiny, so long as they can provide some kind of proof that the signing occurred and that the counterparty signed with an understanding that the electronic signature was the same as a real signature.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#120

Post by qubex »

cgrand-net wrote: post #39
jonchang wrote: post #13

Earlier quoted context omitted.

From the link: "For bureaucratic reasons, a colleague of mine had to print, sign, scan and send by email a high number of pages. To save trees, ink, time, and to stick it to the bureaucrats, I wrote this script." So yes, it does seem like there are situations where a "digital" signature is insufficient.

My bank used to reject scans but accept faxes... bureaucratic reasons.

I read on NH yesterday (or perhaps the day before) that in the USA HIPAA (Health Insurance Portability & Accountability Act 1996) carves our a special exemption to consider faxes ‘secure’.
Post reply on HN