Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

gitlab.com

Post reply on HN
Print view View original

161–170 of 191 posts

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#161

Post by PeterisP »

AnthonyMouse wrote: post #82
toomuchtodo wrote: post #11

Earlier quoted context omitted.

Digital signatures also have legal status in the US. Until society catches up and uses cryptographic primitives provided by a national ID smart card (such that Estonia has) for authorizing intents, this is a satisfactory method to make document execution less painful. This project is already doing the easy part (“place pretty signature picture here”). Depending on your jurisdiction and their tolerance, you could also…

> national ID smart card National ID systems are an incredibly bad idea. You can already get the entire authentication benefit from using decentralized ID systems (your bank authenticates you with your bank card, your employer authenticates you with your employee ID), so all a national ID adds is the ability for corporations to correlate all your different identities without your knowledge or consent, which is nothin…

It's interesting to see a mention of the ability "to correlate all your different identities" as a feature, which probably illustrates fundamental conceptual differences in different legal/social systems.

In European continental civil law (as opposing to common law e.g. USA and UK, as far as I understand UK law) there's no such legal concept as "different identities" or legal aliases - you have one identity, and that's it. You must have an official identity (it's a crime for adults to not have that official ID registered/issued) and you can't have more than one. There's no right to assume or use a different identity, doing so for any benefit is fraud or forgery. If you change your name, then that must be published so that it's trivial for anyone to link these "identities", or, more accurately, know that the same identity used a different name until a particular day.

That has some disadvantages (e.g. lack of pseudonymity - either you're not identified at all, or you're fully identified) and some advantages e.g. in commerce it's generally useful to have a strong identification of your counterpart rather than a weak one; and it eliminates a whole class of "identity confusion" for people with matching names and other features - there's a single "source of truth" for identity, and it can reliably distinguish all the different John Smiths.

If we're looking at the risk of compromise, it's worth noting that the whole concept of 'identity theft' is widespread in countries with weak ID systems like USA and not widespread in places with strong centralized IDs like continental Europe. A chain is as strong as its weakest point; if it's plausible that you might be using some weak form of ID (or even just 'something you know' like social security number/mother's maiden name/etc), then someone else can pretend to be you using that weak form of ID.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#162

Post by PeterisP »

tecleandor wrote: post #65
bagacrap wrote: post #57

Earlier quoted context omitted.

Passport

Not everybody has a passport. A Passport costs more than a hundred dollars. Not everybody is eligible to a passport. For having a passport you need nationality, and you need to be able to have contracts with non national persons.

Your comment about nationality seems interesting - it's a fundamental human right to have nationality (https://www.ohchr.org/EN/Issues/Pages/Nationality.aspx); what do you mean by "non national persons" ? The common mass cases e.g. illegal immigrants are not non-national persons, they're just nationals of some other country. There are certain edge cases that result in stateless people, but the general solution for that is for states to work to assign nationality, it's definitely reasonable in many countries to not be able to have standard contracts with such people until they get their identity documents issued.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#164

Post by peteretep »

aclimatt wrote: post #71

Ha! My co-worker made one of these for the same reason. Some places still require "wet" signatures, and some people (us) like to stick it to bureaucracy and prove that they can't tell the difference. For a one-liner, if you use any tool to generate a realistic version of your signature, or do what I do and actually scan a version of your signature once, and then have that as a PNG that you can drop on any PDF of your…

This is cool, although after playing with it and a bit and doing some Googling, I like:

https://gist.github.com/andyrbell/25c8632e15d17c83a54602f6ac...

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#165

Post by verall »

derefr wrote: post #130
Xylakant wrote: post #121

Earlier quoted context omitted.

When the relevant laws were made, fax machines were purely analog devices, not a scanner attached to a modem. And once fax was legally privileged, it stuck around exactly because it was legally privileged - despite the change in technology.

Again, my question: > fax machines were purely analog devices, not a scanner attached to a modem Why would an analog scanner not still be a scanner? I'd call whatever component that's in even the oldest fax machines "a scanner." Even if it is "enitrely analog" (continuous brightness intensity read, like a tape head or record-player stylus) you'd still call the process of converting light from a sensor passing over a…

Yes, in the same sense that an analog telephone is recording you by translating your voice into electricity. But, at least to me, if it is voice -> electricity on wire -> speaker, it feels much less like recording than saving a buffer of voice in memory, packetizing, and then sending, even if they are both just electricity on a wire.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#166

Post by nimish »

varenc wrote: post #149
mikehollinger wrote: post #9

Mac’s pdf viewer Preview has a signature capture feature built in that’s pretty slick. I use it all the time and haven’t encountered an objection. Tbh I’d wonder why you need to fuzz up and fake scan the image. If someone’s requiring that the doc be “signed in ink” or some such, more power to you!

I love this feature of Preview, though I also sometimes have people that insist on receiving a wet ink signature... Dropbox's "Scan Document" feature is great for getting around that. It turns a photo into what looks exactly like a scan. I just sign the document in Preview, and then use the Scan Document feature to just "scan" the document as its displayed on my screen. The result seems indistinguishable from a print…

A scanner is just a really elongated camera so this is a pretty good way to emulate it

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#167

Post by loeg »

mindslight wrote: post #138
loeg wrote: post #129

Earlier quoted context omitted.

SSNs are problematic because they are expected to be both public and confidential. In reality, they're public. The federal government refuses to issue actual public IDs, which would solve the problem nicely, for political reasons. They can't retract Social Security.

That is one reason they're problematic, but not the problem I described. Public IDs would make the problem I am describing worse , as even more businesses would unashamedly ask for them. People's feeling of "oh isn't that private" is one of the few things holding back everyday retail businesses from asking for them.

I don't think it would be any worse than the status quo. Some businesses might not ask for your SSN in particular, but adtech can identify you pretty uniquely regardless. And in the meantime, a million businesses have your sensitive, private SSN, and a relatively high risk of data breach.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#168

Post by jkaplowitz »

somehnguy wrote: post #101
swixmix wrote: post #92

Earlier quoted context omitted.

It depends on the threat model. If I need to prove to a court in the US, then I'm signing paper and faxing it. To do it differently would be more expensive to prove.

Right, the legal system considers it secure. I'm talking about the technical sense. Where there is no encryption at all, anyone with a phone line splitter can listen in, and the machines are usually not in a secured area so anyone could just pick up the fax and walk away. Not secure at all.

It depends on what your threat model is. The attacks you're talking about are real, absolutely.

For the threat model of a physically local attacker with either the right timing (for grabbing an incoming fax) or the right knowledge (for the phone system equivalent of tcpdump), you're quite right that fax is insecure. Likewise for state sponsored adversaries or certain organized crime groups.

But if you just want to make it hard for people scanning the internet to see what juicy corporate espionage they can find and resell, without specifically targeting you, fax is probably less vulnerable to that threat model than, for example, an undermaintained email server. Likewise if you piss off script kiddies somewhere on the internet with botnets and exploit kits, your website is probably a bigger risk than your fax machine.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#169

Post by DeathArrow »

mr_toad wrote: post #155
DeathArrow wrote: post #93

I could use a mobile app to do that. In my country, to leave your home to do shopping in this period, you are required by military ordnance to fill a form stating the reason of leaving your home. You can show it on your mobile phone, but you have to print it, sign by hand and take a picture of it.

What if you don’t have a working printer at home? Do they just let you starve?

You can write the thing by hand.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#170

Post by globular-toast »

Last time I had to do this was for a two page document which required a signature on the second page. Even though I thought it was silly, I did sign the second page in ink and scanned it. It was rejected because I didn't also scan the first page despite it requiring no changes. At that point I just concatenated the original first page to my initial signed scan and sent it back and it was all fine.

Ridiculous.

One thing I did think about, though, is the legal aspect. Fraud is a serious crime and I wonder if such a thing, however silly, might just be considered fraud. In that case it might not be worth fighting the bureaucracy.

Post reply on HN