The dubiousness of digitized signature services • Hacker News Board

Re: The dubiousness of digitized signature services

#21

Post by Edmond » Sun, Nov 22, 2020, 3:47 PM UTC

castillar76 wrote: post #10

I don't necessarily disagree with the idea of services like this, but in order for the Certisfy Partner's certificate issuance to mean something, it can't just be J. Random Noob who works out of the café down the road selling attested signatures for five bucks. The whole point of PKI is that I'm trusting a third party to perform verifications on my behalf--it rather defeats the purpose if the third party in question…

Developer of the Certisfy service here.

>I find it interesting that a couple people on their partners list are Notaries Public--adding digital signature to the list of functions a Notary can perform would make the migration to digital signatures easier.

That's the main idea here, to delegate trust generation to appropriate entities...this would scale to meet the need of the internet. Today, unless you have hundreds of billions in the bank like facebook, information verification is not practical.

Re: The dubiousness of digitized signature services

#22

Post by indymike » Sun, Nov 22, 2020, 3:55 PM UTC

I own a small payment processor. One of the biggest problems we have is on-boarding new customers. The issue is the banks and service providers we work with require physically signed documents, or we have to use their online signature solution. Their solution is often a worse experience than signing with paper, scanning and emailing. The provided solutions also are about as secure as emailing without encryption, too. Interestingly enough, most of these solutions just overlay a png image of the signature (sometimes collected from the user, sometimes picked from a list) on a PDF and then sign the document with the provider's cert. The final, signed document is delivered via email (hey, post to a webhook, it's 2020?). It would be nice to be able to have our own, better experience that worked with our vendor.

Re: The dubiousness of digitized signature services

#23

Post by BlackFly » Sun, Nov 22, 2020, 3:57 PM UTC

ghaff wrote: post #7

BlackFly wrote: post #4

In this day and age? Just send an email. Your service provider is almost certainly providing a DKIM signature and implicitly with it an attestation that you were authenticated. Desiring any more than that would require a witness able to confirm your identity, even in real life where I can always state that someone else walked in an signed the document.

In all fairness, going to an office in-person and getting something notarized implies 1.) You can actually go to an office in person and seem vaguely legit and 2.) Can present government photo ID. That said, given the issues with going into an office at the moment, I'm finding institutions are finding other ways to verify identity to their satisfaction.

Yes, that is a lot more meaningful than an ordinary signature. Notaries often do a lot more to attest a person's identity as well.

Re: The dubiousness of digitized signature services

#24

Post by Edmond » Sun, Nov 22, 2020, 3:59 PM UTC

satya71 wrote: post #2

The average user is not savvy enough to sign consistently, but can keep a private key secure? That's a big assumption.

This is mainly an app design issue...Certify makes cryptography including the question of keys completely transparent to the user.

The user just needs to learns how to perform some simple operations with the app, they never have to know about private/public keys.

Re: The dubiousness of digitized signature services

#25

Post by indymike » Sun, Nov 22, 2020, 4:00 PM UTC

Edmond wrote: post #18

Developer of Certisfy here. Happy to address questions. Also send me an email (in profile), I can issue you a short lived trustworthy certificate to try out the service :)

This is a very ambitious idea you are pursuing. Do you have any traction with banking?

Re: The dubiousness of digitized signature services

#26

Post by paultopia » Sun, Nov 22, 2020, 4:03 PM UTC

For serious identity variation in paper legal land we don't use signature matching, we use notaries: show id to a trusted 3rd party who can be later dragged into court, sometimes even with an additional witness to vouch for identity.

(In closely related news, just try buying a house during a pandemic, I dare you. There are amusing pictures floating around online of my wife and I shoving documents back and forth through barely-cracked car windows for notarization ...)

Re: The dubiousness of digitized signature services

#27

Post by vageli » Sun, Nov 22, 2020, 4:09 PM UTC

paultopia wrote: post #26

For serious identity variation in paper legal land we don't use signature matching, we use notaries: show id to a trusted 3rd party who can be later dragged into court, sometimes even with an additional witness to vouch for identity. (In closely related news, just try buying a house during a pandemic, I dare you. There are amusing pictures floating around online of my wife and I shoving documents back and forth throu…

> (In closely related news, just try buying a house during a pandemic, I dare you. There are amusing pictures floating around online of my wife and I shoving documents back and forth through barely-cracked car windows for notarization ...)

I closed on a house a month ago. Notarization was done online by smartphone. Worst part was working with a local bank that had little to no online services.

Re: The dubiousness of digitized signature services

#28

Post by Edmond » Sun, Nov 22, 2020, 4:10 PM UTC

indymike wrote: post #25

Edmond wrote: post #18

Developer of Certisfy here. Happy to address questions. Also send me an email (in profile), I can issue you a short lived trustworthy certificate to try out the service :)

This is a very ambitious idea you are pursuing. Do you have any traction with banking?

No banking relationships yet, we're just putting it out there for now to prove the concept.

Ultimately the goal is to create a service that can serve as a generic and scalable solution for internet information trust. Everything from dating/social-media profiles to academic credentials can be authenticated with a service like this, all while preserving user privacy.

Re: The dubiousness of digitized signature services

#29

Post by buckminster » Sun, Nov 22, 2020, 4:13 PM UTC

These signature services make no sense. My UK estate agent is trying to get me to use an American signature service to renew my lease.

- What I get is an email from a third party (the signature service) with whom I have no business relationship. Why would I trust anything they say?

- How do I know the agent has signed the lease?

- What can I do if the American service claims I signed a contract when I didn't? If I sign even a single contract with them I'm effectively giving them power of attorney to accept any contract on my behalf.

- Anyone who gains access to my email can enter contracts on my behalf.

It's mad.

The point of signing a contract in each other's presence is that both parties understand they are agreeing to something, and both have no doubt that the other is also entering the agreement. Online signature services do not achieve this.

And finally, PKI is worse. I won't rehearse the arguments. Read Ross Anderson.

Re: The dubiousness of digitized signature services

#30

Post by [deleted] » Sun, Nov 22, 2020, 4:14 PM UTC

paultopia wrote: post #26

For serious identity variation in paper legal land we don't use signature matching, we use notaries: show id to a trusted 3rd party who can be later dragged into court, sometimes even with an additional witness to vouch for identity. (In closely related news, just try buying a house during a pandemic, I dare you. There are amusing pictures floating around online of my wife and I shoving documents back and forth throu…

[deleted]