Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

gitlab.com

Post reply on HN
Print view View original

181–190 of 191 posts

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#181

Post by nybble41 »

toomuchtodo wrote: post #112
brewdad wrote: post #111

Earlier quoted context omitted.

You do need the SSN to match up with the name and other personal information like age, gender, address, etc. In that way, it's a bit like authenticating with a common username and a password that is publicly available with the username obfuscated (except in the case of data leaks).

Instead of a unique ID like a SSN, we should be using an identity provider to support such use cases. Imagine instead that you would authenticate with https://login.gov (ideally with your credentials and a hardware 2FA device), which would then attest to whatever service you were logging in to that you are you. You can't rotate a social security number with reasonable effort, and we can longer treat it as a secret, b…

Now imagine that for whatever reason you suddenly become persona non grata, and https://login.gov/ refuses to attest that you are you to any of the services you have come to depend on.

Or just imagine https://login.gov/ passively collecting information about all the services you're logging into.

I wouldn't be opposed to common login protocol—preferably a distributed or federated one—where the government and other parties can add their own signatures to attest that a particular identity belongs to a certain real-world person, and you can choose which of those signatures you present to any given service. However, having the login itself go through a government server would be an incredibly bad idea.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#182

Post by nybble41 »

hyperman1 wrote: post #179
AnthonyMouse wrote: post #177

Earlier quoted context omitted.

You have to realize that the entire concept of "identity theft" comes from having centralized identity to begin with, otherwise there is nothing to "steal". Suppose you want to take out a mortgage on a house. If you take it out in someone else's name, this is a problem. But suppose that didn't even enter into it. Instead you prove title to the house, i.e. you authenticate to the city title office as owner of that pro…

You realize there is a centralized identity here: The house, or whatever identifies it e.g. street and number. Also, as a counterpoint, most countries have much stronger centralized identities than the USA, and much less trouble with identity theft.

That's one identity, but the owner of the house would have other identities. The fact that you know that the owner of the house approved the lien would not automatically tell you that, for example, the person living in the house approved the lien. Or that a certain employee of a certain company approved it. These would all be separate identities, even if they all refer to the same person.

Even in countries with unique, centralized identities, you don't go around handing your government ID to everyone you meet. You use it for official legal business only. In other contexts you still have less formal identities which remain separate from your official identity.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#183

Post by toomuchtodo »

nybble41 wrote: post #181
toomuchtodo wrote: post #112

Earlier quoted context omitted.

Instead of a unique ID like a SSN, we should be using an identity provider to support such use cases. Imagine instead that you would authenticate with https://login.gov (ideally with your credentials and a hardware 2FA device), which would then attest to whatever service you were logging in to that you are you. You can't rotate a social security number with reasonable effort, and we can longer treat it as a secret, b…

Now imagine that for whatever reason you suddenly become persona non grata , and https://login.gov/ refuses to attest that you are you to any of the services you have come to depend on. Or just imagine https://login.gov/ passively collecting information about all the services you're logging into. I wouldn't be opposed to common login protocol—preferably a distributed or federated one—where the government and other pa…

We're already at that point (driver's licenses, passports) and it hasn't happened yet. Yes, you can get blacklisted by the TSA for air transport, but they have an exception process for that (redress control number).

Proper functioning of democracy and government requires eternal vigilance (apologies to Jefferson).

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#184

Post by zelly »

sterlind wrote: post #157
zelly wrote: post #89

Earlier quoted context omitted.

Signatures being meaningful is a downright American tradition. The country was founded based on signatures. It is never going away. Crytographic protocols can be added to verify signing, but until every civilian practices perfect opsec (never gonna happen), in-person signatures in front of a notary will always be the way business is done. Better technology (this program, Photoshop, deepfakes, quantum prime factorizat…

Post-quantum digital signature algorithms based on lattices are starting to get secure, efficient and based on simple mathematical constructs. IIRC, the basic construction is you generate a lattice trapdoor matrix R, such that A*(Rt + e) ~= t. Finding an input p with small coefficients, for some t such that Ap = t reduces to one of lattice reduction problems, since it requires a finding "good" basis for the lattice (…

Are there any widely analyzed implementations that I can use today? Got any links? I'm interested, but I don't think I'd understand without seeing code.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#185

Post by nybble41 »

toomuchtodo wrote: post #183
nybble41 wrote: post #181

Earlier quoted context omitted.

Now imagine that for whatever reason you suddenly become persona non grata , and https://login.gov/ refuses to attest that you are you to any of the services you have come to depend on. Or just imagine https://login.gov/ passively collecting information about all the services you're logging into. I wouldn't be opposed to common login protocol—preferably a distributed or federated one—where the government and other pa…

We're already at that point (driver's licenses, passports) and it hasn't happened yet. Yes, you can get blacklisted by the TSA for air transport, but they have an exception process for that (redress control number). Proper functioning of democracy and government requires eternal vigilance (apologies to Jefferson).

You don't need your driver's license or passport to log in to your e-mail or Facebook account and communicate with your friends, or to buy groceries. Revoking your driver's license and passport affects your ability to travel long distances and not much else, at least in the short term. It's bad enough that you need a current government ID for domestic flights; we don't need to make it mandatory for everything.

> Proper functioning of democracy and government requires eternal vigilance

Indeed, and part of that vigilance is pushing back against government involvement in areas they have no business in, such as authentication for non-government services.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#186

Post by rolandog »

I was thinking of doing something like this the day before yesterday! I love your implementation! Extremely useful.

I actually wrote about the laborious effort to create a pseudo 'false document' by manually using Gimp on my blog; I wrote a very naive back-of-a-napkin pseudo algorithm... I was actually thinking about learning Gimp's Script-Fu to generate the signature with the Ink Tool.

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#187

Post by fastball »

nybble41 wrote: post #185
toomuchtodo wrote: post #183

Earlier quoted context omitted.

We're already at that point (driver's licenses, passports) and it hasn't happened yet. Yes, you can get blacklisted by the TSA for air transport, but they have an exception process for that (redress control number). Proper functioning of democracy and government requires eternal vigilance (apologies to Jefferson).

You don't need your driver's license or passport to log in to your e-mail or Facebook account and communicate with your friends, or to buy groceries. Revoking your driver's license and passport affects your ability to travel long distances and not much else, at least in the short term. It's bad enough that you need a current government ID for domestic flights; we don't need to make it mandatory for everything . > Pro…

Nobody is proposing a system where you need to authenticate with some national ID in order to do any of the things you mentioned.

We are talking about having better authentication (both more privacy-aware and more flexible) for situations where it's needed. You don't need to validate your identity for email, facebook, or groceries, so obviously this wouldn't apply there. This would apply to things where some ID auth is already taking place (e.g. anything that asks for your SSN, KYC processes in general, etc).

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#188

Post by tecleandor »

PeterisP wrote: post #162
tecleandor wrote: post #65

Earlier quoted context omitted.

Not everybody has a passport. A Passport costs more than a hundred dollars. Not everybody is eligible to a passport. For having a passport you need nationality, and you need to be able to have contracts with non national persons.

Your comment about nationality seems interesting - it's a fundamental human right to have nationality ( https://www.ohchr.org/EN/Issues/Pages/Nationality.aspx); what do you mean by "non national persons" ? The common mass cases e.g. illegal immigrants are not non-national persons, they're just nationals of some other country. There are certain edge cases that result in stateless people, but the general solution for t…

I might live in in a country I'm not a national, so I don't have a local passport.

Illegals often cross borders without papers, so they don't have any passports to sign anything.

Sorry I'm brief, but I'm super busy today :P

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#189

Post by sterlind »

zelly wrote: post #184
sterlind wrote: post #157

Earlier quoted context omitted.

Post-quantum digital signature algorithms based on lattices are starting to get secure, efficient and based on simple mathematical constructs. IIRC, the basic construction is you generate a lattice trapdoor matrix R, such that A*(Rt + e) ~= t. Finding an input p with small coefficients, for some t such that Ap = t reduces to one of lattice reduction problems, since it requires a finding "good" basis for the lattice (…

Are there any widely analyzed implementations that I can use today? Got any links? I'm interested, but I don't think I'd understand without seeing code.

It's a pretty bleak landscape, code-wise. The PALISADE crypto library is an implementation of many of these primitives in C++, but it will be nearly impossible to understand it without reading the papers. I recommend "Trapdoors for Lattices: Simpler, Tighter, Smaller, Faster" [0] and the many papers that build on it. That paper was fairly accessible to a layperson like myself. if you're interested you could play around with it in Sympy or Mathematica.

0. https://eprint.iacr.org/2011/501

Re: Show HN: FalsiScan – Make it look like a PDF has been hand signed and scanned

#190

Post by dd36 »

loeg wrote: post #128
monkpit wrote: post #108

Earlier quoted context omitted.

I don’t think you need to argue that fax is not technically secure on HN. Pretty sure we are all on the same page there. What matters is legal precedent and existing policy in various countries.

> I don’t think you need to argue that fax is not technically secure on HN. Pretty sure we are all on the same page there. dd36 and swixmix seem to be taking the other side of that argument.

If I were taking that side, I wouldn’t have qualified my statement. Gov’t and courts consider it secure. HIPAA compliant, etc.
Post reply on HN