The dubiousness of digitized signature services
blog.certisfy.com
The dubiousness of digitized signature services
1–10 of 70 posts
Re: The dubiousness of digitized signature services
#2The average user is not savvy enough to sign consistently, but can keep a private key secure? That's a big assumption.
Re: The dubiousness of digitized signature services
#3I've always seen the value of signatures as a ceremony first, not as a (serious) method of authentication. As an example, when have you last seen a merchant compare your signature to that on your credit card?
Conduct implying intent, together with a hand-written signature, can go a very long way in practice.
The value of these services to me accordingly seems to be in their accuracy of replicating the ceremony, not in trying to compete with cryptographic signatures.
Re: The dubiousness of digitized signature services
#4In this day and age? Just send an email. Your service provider is almost certainly providing a DKIM signature and implicitly with it an attestation that you were authenticated. Desiring any more than that would require a witness able to confirm your identity, even in real life where I can always state that someone else walked in an signed the document.
Re: The dubiousness of digitized signature services
#5I've always seen the value of signatures as a ceremony first, not as a (serious) method of authentication. As an example, when have you last seen a merchant compare your signature to that on your credit card? Conduct implying intent, together with a hand-written signature, can go a very long way in practice. The value of these services to me accordingly seems to be in their accuracy of replicating the ceremony, not i…
I see it more like a legal talisman. A pseudo legal thing that people think is necessary to make a contract real. It can be helpful for proving that a contract existed, but there are alternatives.
Re: The dubiousness of digitized signature services
#6Signatures generally have mostly become a total joke. I suppose there's some element, for many of us, that there's something vaguely scrawled that looks like other vague scrawls that indicate I may have glanced at a piece of paper. But, especially, at the current time having clean and dirty pen cups so we can sign a paper receipt or have to sign a digital pad with what's effectively just an X?
At least my financial institution was willing to work with a phone call, mobile phone number, and email for something rather than having to go in and do the notary thing.
Re: The dubiousness of digitized signature services
#7In this day and age? Just send an email. Your service provider is almost certainly providing a DKIM signature and implicitly with it an attestation that you were authenticated. Desiring any more than that would require a witness able to confirm your identity, even in real life where I can always state that someone else walked in an signed the document.
In all fairness, going to an office in-person and getting something notarized implies 1.) You can actually go to an office in person and seem vaguely legit and 2.) Can present government photo ID. That said, given the issues with going into an office at the moment, I'm finding institutions are finding other ways to verify identity to their satisfaction.
Re: The dubiousness of digitized signature services
#8The average user is not savvy enough to sign consistently, but can keep a private key secure? That's a big assumption.
If the private key is in a smart card, why not? Some countries like Estonia include smart cards in their national IDs.
Re: The dubiousness of digitized signature services
#9The average user is not savvy enough to sign consistently, but can keep a private key secure? That's a big assumption.
I can't do the former, i can attempt the later.
I'm sure some service would figure out a way.
Re: The dubiousness of digitized signature services
#10I don't necessarily disagree with the idea of services like this, but in order for the Certisfy Partner's certificate issuance to mean something, it can't just be J. Random Noob who works out of the café down the road selling attested signatures for five bucks. The whole point of PKI is that I'm trusting a third party to perform verifications on my behalf--it rather defeats the purpose if the third party in question is no more trustworthy than the person requesting their attestation.
That said, I find it interesting that a couple people on their partners list are Notaries Public--adding digital signature to the list of functions a Notary can perform would make the migration to digital signatures easier. It would probably require making the Notary's signature part of a public chain maintained and issued by the local government as part of their licensure, though, so I don't see where Certisfy comes into that picture at all.