Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned • Hacker News Board

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#121

Post by Xylakant » Wed, Apr 08, 2020, 6:38 PM UTC

derefr wrote: post #107

anonymfus wrote: post #96

Earlier quoted context omitted.

Conventional fax machine transmits document while it scans it as it has (almost) no memory. Like analog TV camera, just much slower.

Sure, but that's still "a scanner attached to a modem." Nothing about a scanner implies that it must buffer the input, just like nothing about a printer implies that it buffers the output. There are/were "line printers" doing "latch a character from the input line, print the character, unlatch" serial output (which were so common that Unix pipes are designed around the foibles of outputting to such devices.) Most POS…

When the relevant laws were made, fax machines were purely analog devices, not a scanner attached to a modem. And once fax was legally privileged, it stuck around exactly because it was legally privileged - despite the change in technology.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#122

Post by chipsa » Wed, Apr 08, 2020, 6:39 PM UTC

derefr wrote: post #86

Xylakant wrote: post #76

Earlier quoted context omitted.

In Germany, a fax is legally considered an original copy, a scan/print is not, despite a fax often being a scan that’s then transmitted via fax protocols. Law hasn’t caught up with technology yet in that area. You also get a confirmation from the recipient when using fax.

> despite a fax often being a scan that’s then transmitted via fax protocols ...what's the alternative to that "often"? What is a fax machine, if not a scanner attached to a modem?

VoIP fax services. Webpage allows upload, sends the fax over voip, which ends up at another voip server, decodes back into a fax. Never turns analog.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#123

Post by squarefoot » Wed, Apr 08, 2020, 6:41 PM UTC

NelsonMinar wrote: post #73

mikehollinger wrote: post #9

Mac’s pdf viewer Preview has a signature capture feature built in that’s pretty slick. I use it all the time and haven’t encountered an objection. Tbh I’d wonder why you need to fuzz up and fake scan the image. If someone’s requiring that the doc be “signed in ink” or some such, more power to you!

Schwab (the bank in the US) started rejecting my signatures, on the basis that several documents I submitted had identical signature images. I worked around that by making a new signature, but you could imagine them escalating to also complaining about the fact it was not wet ink.

Several years ago my bank had to store three signatures because I couldn't (and still can't) produce two identical ones. Last year I had to update some documentation and they had to store two more signatures, so now I have 5, but any other signature will be different anyway. The reason is likely that, as a leftie, since being a kid I had to suffer a few attempts to force me writing with the right hand, something I trained by myself much later in my 20s out of curiosity, but quickly forgot due to lack of practice. I never perfected my horrible handwriting and resorted to block capitals immediately after school; then computers and printers solved the problem. Unfortunately it seems there's no way to get rid of this archaic thing called signature that for me translates into wasting lots of time; I'd rather leave a blood sample on paper if I could:)

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#124

Post by Spivak » Wed, Apr 08, 2020, 6:43 PM UTC

bagacrap wrote: post #57

ceejayoz wrote: post #34

Earlier quoted context omitted.

The USA doesn't have a national ID card.

Passport

That's not actually not an ID card dumb as it seems. It's an IOU that says that a collection of documents that are enough to prove your identity to the government were produced to an agent. It's a cert.

Assuming the "standard path" in the US the pieces of your ID are your birth record, any court ordered name changes (like if you got married), your social security card, and a previous cert that ties the name to a photo.

I know it's pedantic but god damn it's annoying as hell that a passport doesn't actually prove anything or else you could always do $old_valid_passport + $valid_photo = $new_passport but nope. Sometimes you hit special cases that drop you into having to prove your identity from your ID documents all over again.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#125

Post by mercora » Wed, Apr 08, 2020, 6:43 PM UTC

turbinerneiter wrote: post #6

I don't get the magical power of a signature at all. Everybody can write my name under a document. This project basically allows you to forge your own signature. Is it still legally binding? Do these rules even remember the original intent?

i think its possible to analyze signatures in various ways that are hard to replicate. but a copy is always just a copy. What i beleive the thing here is that there are court proven ways to analyze writing styles in signatures and some more forensic methods to analyze paper and pen.

as a side note: every time i get a new passport or id card i get told that my signature is not ok as it is (apparently not enough recognizable characters) but when confronted with the question how they would like me to change my signature as seen on all previous documents signed by me they shut up. I think its funny because it probably makes it even more unique.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#126

Post by bcoates » Wed, Apr 08, 2020, 6:44 PM UTC

somehnguy wrote: post #101

swixmix wrote: post #92

Earlier quoted context omitted.

It depends on the threat model. If I need to prove to a court in the US, then I'm signing paper and faxing it. To do it differently would be more expensive to prove.

Right, the legal system considers it secure. I'm talking about the technical sense. Where there is no encryption at all, anyone with a phone line splitter can listen in, and the machines are usually not in a secured area so anyone could just pick up the fax and walk away. Not secure at all.

They're secure in the sense of being low-risk for active content shenanigans and a small surface area for vulnerabilities. Attacking a network through a .tiff of a fax is a lot harder than attacking it through an email, pdf, word doc, http session, etc.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#127

Post by loeg » Wed, Apr 08, 2020, 6:49 PM UTC

qubex wrote: post #120

cgrand-net wrote: post #39

Earlier quoted context omitted.

My bank used to reject scans but accept faxes... bureaucratic reasons.

I read on NH yesterday (or perhaps the day before) that in the USA HIPAA (Health Insurance Portability & Accountability Act 1996) carves our a special exemption to consider faxes ‘secure’.

It does.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#128

Post by loeg » Wed, Apr 08, 2020, 6:51 PM UTC

monkpit wrote: post #108

somehnguy wrote: post #101

Earlier quoted context omitted.

Right, the legal system considers it secure. I'm talking about the technical sense. Where there is no encryption at all, anyone with a phone line splitter can listen in, and the machines are usually not in a secured area so anyone could just pick up the fax and walk away. Not secure at all.

I don’t think you need to argue that fax is not technically secure on HN. Pretty sure we are all on the same page there. What matters is legal precedent and existing policy in various countries.

> I don’t think you need to argue that fax is not technically secure on HN. Pretty sure we are all on the same page there.

dd36 and swixmix seem to be taking the other side of that argument.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#129

Post by loeg » Wed, Apr 08, 2020, 6:54 PM UTC

mindslight wrote: post #114

JorgeGT wrote: post #35

Earlier quoted context omitted.

Yep, and here the government even provides you with a free qualified certificate to sign.

That doesn't work for the US, because any constraints on use are politically unpalatable. Any capability that the government creates thus turns into a security vulnerability to be exploited by business. For example, even just assigning everybody unique identifiers (social security number, drivers' license number) has allowed businesses to demand these identifiers to track customers in privately-held surveillance data…

SSNs are problematic because they are expected to be both public and confidential. In reality, they're public.

The federal government refuses to issue actual public IDs, which would solve the problem nicely, for political reasons. They can't retract Social Security.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#130

Post by derefr » Wed, Apr 08, 2020, 7:01 PM UTC

Xylakant wrote: post #121

derefr wrote: post #107

Earlier quoted context omitted.

Sure, but that's still "a scanner attached to a modem." Nothing about a scanner implies that it must buffer the input, just like nothing about a printer implies that it buffers the output. There are/were "line printers" doing "latch a character from the input line, print the character, unlatch" serial output (which were so common that Unix pipes are designed around the foibles of outputting to such devices.) Most POS…

When the relevant laws were made, fax machines were purely analog devices, not a scanner attached to a modem. And once fax was legally privileged, it stuck around exactly because it was legally privileged - despite the change in technology.

Again, my question:

> fax machines were purely analog devices, not a scanner attached to a modem

Why would an analog scanner not still be a scanner? I'd call whatever component that's in even the oldest fax machines "a scanner." Even if it is "enitrely analog" (continuous brightness intensity read, like a tape head or record-player stylus) you'd still call the process of converting light from a sensor passing over a document, into electricity, scanning, and you'd still call the component that does that "a scanner." Just like speakers and microphones are still "speakers" and "microphones" whether they're just transducers attached to wires, or have a whole ADC+USB/Bluetooth signal path leading out of them. Am I wrong?