Live data from Hacker News

FalsiScan: Make it look like a PDF has been hand signed and scanned

gitlab.com

371–380 of 399 posts

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#371
Bonus points if you wrap the script in an Automator task in macOS so you can you run it in literally 2 clicks from Finder: https://bradt.ca/blog/how-to-make-a-pdf-look-scanned-imagema...

It is even easier now with Shortcuts in the latest macOS releases.

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#372
post #156

Earlier quoted context omitted.

When you move to a new state, I suppose you don't fill in a bunch of forms to register yourself as a resident in the state then? So that when DMV and other institutions ask for residency they could just check back in the states records (or have you bring a copy of the state's residency certificate) ? The state surely must know how to tax you, and thus they need to know who you are and that you're a resident in the st…

In the US, no, you don't need to fill out any forms to register yourself as a resident. The closest is probably moving your drivers license registration, which many people wait years to do after moving. Other than that, you generally prove residency by showing (as GP mentioned) bills mailed to you, or a copy of your lease. You're responsible for filing your own state taxes based on when/how/where you worked.

I hope you mind me not asking but while I know on some general level how things work in the US the details are infinitely interesting the deeper I think about this.

You're responsible for filing your own state taxes based on when/how/where you worked.

This seems like having so many knots left untied, considering how much importance one might expect to be placed for a fundamental question such as residency.

The obvious case is that it seems like people could just move into a state and never tell anyone and omit paying taxes. While there must be mechanisms to prevent or curb this, it still probably applies to a non-trivial minority of so-inclined people already? Not an option for people who want to settle, of course, but for certain people, living some months or years anonymously in a particular state might be a viable opportunity.

Do counties / cities / towns also lack similar logging of identity? How can they offer public services to people if they really don't know who the people are, and most importantly, if the people are residents or not? Does everyone just keep showing their utility bills? How do they deal with the various John Smiths moving from place to place -- inevitably to addresses where another John Smith was living before as there will be collisions without an unique identity? Or does the driving license become the de-facto proof of residence once people move it over, and the driving license has a unique number to differentiate between individuals regardless of name and address?

I mean, for the state government there's an inevitable and pragmatic need for uniquely identifying the people who live in the state and if there's no central registry then this need will be approxximated by various mechanisms so that the society can function at all.

Conversely, let's say the government does track down residents who nobody officially knows about. If the state government really doesn't know who lives in that state how could they impose liabilities such as taxes onto people whose identity and location and length of official residence they don't know? If I move in with my friend who lives in another state at which point can I still say "I'm just visiting, no taxes me for, thank you" and if the state were to disagree how would they go about establishing I was a resident after all? How would I prove I'm still actually a resident in the old state (if I were) vs how could they prove I'm no longer a resident in the old state (if I weren't)? What is the mechanism that prevents me from living in two states and claiming always in one that I'm resident in the other state?

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#373
Am i the only one who finds the current state of signing documents to be a bit incomplete, inconsistent and all over the place?

For historical reasons, we still need to allow signing things by hand, which has a number of challenges in proving the authenticity of any such signature and preventing falsification of signatures (especially if you don't have the original document with the ink but rather a scanned copy).

Then, there are digital signatures, though instead of one large standard for all of the world, we have a whole bunch of regional ones. For example, in Latvia we have eParaksts (translates to "eSignature"): https://www.eparaksts.lv/en/

It is a largely commercial venture, which allows signing documents with either data in the chip that's embedded in our national ID, or i guess mobile solutions as well and also gives you the ability to verify these arbitrary documents in a centralized manner as well. The good thing here is that it supports signing arbitrary documents and storing them in an .edoc container or even embedding the signature inside of PDFs or whatever, but it still feels very regional, is still centralized and most of the software for reading PDFs directly doesn't recognize their CA or intermediate certs as trusted and therefore gives you errors, so you need to do verification on their site.

But what happens when you need to somehow indicate within a document that you're signing it digitally? You just put the text: "THIS DOCUMENT IS SIGNED WITH AN ELECTRONIC SIGNATURE AND A TIMESTAMP" in text at the bottom, which seems silly and doesn't really mean anything - how are you supposed to examine that if you ever need to print it? Furthermore, this kind of locks you in to using the .edoc container and keeping it around and perhaps even think about how to quickly get and display its contents. Sure, they have desktop software for that, but it's not like you can automate that super easily (not saying that working with digitally signed PDFs is a walk in the park, either).

In some parts of the world, an electronic signature just means taking a JPEG (or an equivalent) of your signature and embedding it in a particular spot of your PDF or whatever, which is plain nonsense in my eyes - sure, it looks pretty, but there's no actual cryptographic protection or benefit to doing so, since it's laughably easy to reproduce by anyone who wants to fake your signature. It actually surprised me when digitally signing a PDF came up as a Linux challenge on Linus Tech Tips and Luke thought that this approach is what was intended (whereas Linus interpreted it more or less correctly but searched for the wrong thing, more or less): https://www.youtube.com/watch?v=TtsglXhbxno&t=257s

So, here's my questions to all of you, maybe you have some thoughts to share:

  - why don't we have one centralized format of signing any and all pieces of data, with a focus on documents? (think GPG but actually used and internationally recognized)?
  - why don't we have one centralized, yet distributed CA infrastructure with intermediate certificates by country and then further nodes for each institution with people's certs being the leaf nodes, so that we can validate any signature globally?
  - why don't we have a format that involves representing this data both in digital and printed form, say, when you want to print a document, it essentially gives you this picture of your signature with a QR code besides it, that either involves enough information to validate this signature (be it crypto data or just an URL in the case of a web based solution), as well as the parsing logic to go the other way when scanning signed documents?
  - how did we get to the point where the above is not our current reality? why didn't document signing ever get the love that something like SSL/TLS did?
  - any ideas on how these things could possibly be improved? thoughts on fully decentralized solution (everyone has a private/public key) vs something that holds one's hands more and provides an easy to use interface or even lets you sign things on your behalf (e.g. like eSignature), ideally behind 2FA?
  - could any such initiative ever be fully free and open source, possibly subsidized by the governments of the world? i mean, (almost) everyone has a pen, but not everyone should pay for DocuSign or whatever, right?

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#374
post #306

Earlier quoted context omitted.

Wouldn't it be cheaper to just push forward with the robot thing rather than some decades-long (Real ID started in 2005 or 6) super-complicated social engineering project? If the goal is find a way to ensure burgers are flipped and toilets cleaned, wouldn't the rational idea be to invest in robotics and involuntary birth control technology, not try to ride herd on a giant mob of poor people who might turn on their "m…

> Wouldn't it be cheaper to just push forward with the robot thing rather than some decades-long (Real ID started in 2005 or 6) super-complicated social engineering project? It’s not super complicated, it’s just the natural consequence of an elite in power wanting to stay that way. You can see it as some kind of class behaviour. It has been going on since as far back as we can see, e.g. in Ancient Greek and Roman soc…

I really appreciate this response and will come back to say more when I'm awake, but just want to acknowledge that you have interesting stuff to say and I want to hear more. Thank you.

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#375

Earlier quoted context omitted.

Yes, and in some contexts people seem to recognize digitally signed PDFs only when they “officially” processed by DocuSign, HelloSign, or a similar professional service.

Well it depends on the laws of each country. In my country (Greece) a digitally signed document is acceptable everywhere at least in the public sector. Actually it's illegal for a public servant to deny a digitally signed document! No professional service is really needed to sign a document; it all depends on the acceptance of the certificate you use for signing by your government/laws. I.e you may need to buy a cert…

While eIDAS is absolutely stupid in how it defines electronic signatures (based on the wording, adding a picture of your signature would suffice), QES is not just any digital signature, as it needs to be coming from a certificate that's issued by a recognized CA and must be in a device that doesn't allow exporting the key.

Other than that, it's awesome not having to deal with this crap, though, public notaries are very unimpressed by this stuff.

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#376
post #219

Earlier quoted context omitted.

Similar issue at our version of the DMV, the Traffic Department. Had to provide proof of address and the only thing I had was the rental agreement with my landlord. But the copy I had was signed by me, but not countersigned by my landlord. The clerk didn't want to accept it. I told him I could just walk out and fake a signature. He said that's OK and that he isn't a policeman. So I countersigned it in front of him. H…

> I told him I could just walk out and fake a signature. He said that's OK and that he isn't a policeman. So I countersigned it in front of him. He paused and then accepted it. Well, I mean, forgery is a class C felony, at least in my state. If you had walked in with the signature on it, the clerk would have had plausible deniability. Your act of forging in front of the clerk took the plausible deniability away, maki…

I'm quite sure he knew what would happen if he didn't accept it. I would rejoin the queue and use another counter.

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#377
post #74

I hate PDF's with a passion. Not once have I ever wanted to use one. All the pinching and zooming, such a waste of time. I'm giving this a shot next time I need one, the whole scanner thing needs to go. Are we stuck in the 90's? Just bought another rental and it was an ordeal trying to find a scanner. Tried the college near me, was denied as you have to be a student. The library is closed down apparently. FedEx didn'…

Just take a photo next time, you can use Office Lens or Apple Notes.

Also Files on iOS has a document scanner hidden in the … menu.

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#378
post #89
post #32

I really hate dealing with my printer (or any printer for that matter), so I make pretty liberal use of my drawing tablet at this point. I import the PDF into Krita, use the ballpoint pen brush, and sign. I export to PNG, then use an imagemagick script to rotate it some random number between 1-3 degrees, and add noise onto it to look like a scan. It's a pain, but it's still less annoying than dealing with a printer.

I have a png of my signature, and I just paste it into the pdf, and submit that. Haven't run into a complaint yet, and I don't have to print anything.

Ditto. I've been doing it 11 years at this point and it's never come back to bite me.

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#379
post #27

Don't know about different Jurisdictions, but from where I am - this has NO legal binding whatsoever. We have those gov issued digital, invisible signatures for that, embedded in our personal ID card. Whatever is properly signed with digital signature, the printed out page bears no legal force. Anyway, businesses still like to do it this way ("Signing" pdf by applying some pixels). I wonder if it is just an inconveni…

This sounds really unlikely. Does your country also not honor any sort of verbal contracts?

Would a business agreement concluded over email not be binding? Can you get away with fraud by just tricking people into agreeing to use docusign?

If (not cryptographically) esigned contracts are not binding in your country, how does that not cripple law enforcements ability to combat fraud involving such contracts?

If I sell you a car and we use a contract like this, do I then get to keep both the car and the money? If not, how is that contract not binding?

Re: FalsiScan: Make it look like a PDF has been hand signed and scanned

#380
post #27

Don't know about different Jurisdictions, but from where I am - this has NO legal binding whatsoever. We have those gov issued digital, invisible signatures for that, embedded in our personal ID card. Whatever is properly signed with digital signature, the printed out page bears no legal force. Anyway, businesses still like to do it this way ("Signing" pdf by applying some pixels). I wonder if it is just an inconveni…

Same here. Real signatures on paper as well as cryptographic signatures are legally binding. Pasting a picture onto a PDF isn't but nobody wants to deal with the bureaucracy so they do it anyway. Getting a cryptographic token you can use to legally sign things is such a bureaucratic nightmare too, nobody wants to do it, including myself and I really like this stuff.

How does it work if you defraud someone using such a a PDF contract with a pasted signature?

You just get away with it because the contract wasn’t binding so there was no fraud, right?

I bet those “non-binding” contracts are actually much more binding than you might think.

Post reply on HN