Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dubiousness of digitized signature services

blog.certisfy.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: The dubiousness of digitized signature services

#51

Post by woah »

This is a very misinformed article. The point of a signature is to make it obvious to both parties that they are making a binding agreement and to bring all the terms of the agreement together in one contract.

A signature also makes it so that someone must commit a felony to misrepresent what you agreed to by forging your signature, no matter how easy it might be to forge. It also creates evidence of their crime.

The article’s complaint seems to be that it might be easy to forge a signature, electronically or physically. Forged signatures are almost never an issue in contract disputes, and when they are, it’s almost always petty small time crime like check fraud.

Solving something that is not actually a problem, using an extremely complicated tool like cryptographic signatures, which require a huge amount of tooling around the storage of private keys and the identification public keys, is backwards.

Re: The dubiousness of digitized signature services

#52

Post by hedora »

crails124 wrote: post #46

I was interested at first because I built a signature product a few years ago. I find it a bit confusing and had to reread to catch the point. There are 3 levels defined by the EU. I use these levels everywhere because it's not really a legal thing but increasing levels of technical requirement. The US has many conflicting laws on what signatures are valid. The lowest level is what you first started out with. The mar…

> What's important is at this level the signer is not actually the person, it's the service.

Interesting. Does this mean that if a scammer uses docsign to phish me into a mortgage transaction, and I lose my house, then docusign is on the hook financially?

Put another way: Are they legally required to sign on behalf of both (purported) parties of the contract in the case of a dispute? What if 99% of signatures are through them, and the last step is a fraudulent notary?

Re: The dubiousness of digitized signature services

#53

Post by woah »

buckminster wrote: post #49
woah wrote: post #45

Earlier quoted context omitted.

It’s hard for programmers to understand signatures and law in general, because it is somewhat similar to programming but with very different rules. The signature is just evidence of an agreement between you and the other party. It is not the only thing that matters. For example, if someone forged your signature on some paper transfer documents, would they then be able to move into your house? No. In your scenario, it…

I understand perfectly well that if it goes wrong I will, most likely, be able to unpick the damage. But I also understand that this can take years and lots of money. Especially if the signature service is in a different country. So-called identity theft is a real problem. My particular concern is that I believe I'm entering into a tenancy but then discover, due to some bug in the software, that the landlord never ac…

Nobody is going to risk jail time to just get a slightly better rent on an apartment or something. There are much better ways to make money if you’re willing to go to jail for fraud. The problem you are concerned about is not a problem.

Re: The dubiousness of digitized signature services

#54

Post by Edmond »

crails124 wrote: post #46

I was interested at first because I built a signature product a few years ago. I find it a bit confusing and had to reread to catch the point. There are 3 levels defined by the EU. I use these levels everywhere because it's not really a legal thing but increasing levels of technical requirement. The US has many conflicting laws on what signatures are valid. The lowest level is what you first started out with. The mar…

Send me an email (in my profile), I am interested in your perspective. PKI/Web of trust are just terminology around the usage of asymmetric key cryptography to solve certain problems.

The service relies on third parties to perform verification and issue certificates, just as the domain name certificate authorities do. The difference is that the information on the certificate can be anything, not just domain names.

Users use the Certisfy app to make use of those certificates, by making various claims against their certificates (think: location, age, name, even height:)..etc)

Think of the app as a kind of trust projection and information verification toolkit/client made for ordinary consumers.

Re: The dubiousness of digitized signature services

#55

Post by hedora »

cesarb wrote: post #34
lxgr wrote: post #3

I've always seen the value of signatures as a ceremony first, not as a (serious) method of authentication. As an example, when have you last seen a merchant compare your signature to that on your credit card? Conduct implying intent, together with a hand-written signature, can go a very long way in practice. The value of these services to me accordingly seems to be in their accuracy of replicating the ceremony, not i…

> As an example, when have you last seen a merchant compare your signature to that on your credit card? What would the merchant compare the signature on the card to? You don't sign a contract when buying groceries, you put in your card and type your PIN. On the other hand, whenever I go to my bank and have to sign something, they do compare my signature with the one they have on file (formerly in a paper card, nowada…

Credit card pins aren’t a thing in the US (debit cards require pins, however).

In theory, the merchant is supposed to look at the signature on the back of the card and compare it with the signature you write on the receipt. You can even write ID REQUIRED and then they’re supposed to check for ID.

In practice, I didn’t bother signing any of my cards for about 15 years. After two cashiers expressed annoyance at my blatant disregard for the rules (a few years apart) I started signing the cards.

Re: The dubiousness of digitized signature services

#56

Post by lxgr »

hedora wrote: post #55
cesarb wrote: post #34

Earlier quoted context omitted.

> As an example, when have you last seen a merchant compare your signature to that on your credit card? What would the merchant compare the signature on the card to? You don't sign a contract when buying groceries, you put in your card and type your PIN. On the other hand, whenever I go to my bank and have to sign something, they do compare my signature with the one they have on file (formerly in a paper card, nowada…

Credit card pins aren’t a thing in the US (debit cards require pins, however). In theory, the merchant is supposed to look at the signature on the back of the card and compare it with the signature you write on the receipt. You can even write ID REQUIRED and then they’re supposed to check for ID. In practice, I didn’t bother signing any of my cards for about 15 years. After two cashiers expressed annoyance at my blat…

> In theory, the merchant is supposed to look at the signature

They are not by the card schemes' rules, and I think they haven't been in quite a while.

> You can even write ID REQUIRED and then they’re supposed to check for ID.

Yes, but they are also supposed to make you sign on the spot after checking your ID. No signature on the card, no purchase – at least officially.

Vice versa, "ID REQUIRED" has no consequences (by scheme rules at least).

Re: The dubiousness of digitized signature services

#57

Post by marcus_holmes »

combatentropy wrote: post #33
marcus_holmes wrote: post #15

Earlier quoted context omitted.

The point of a physical signature is not that anyone else can prove you signed something. It's that if you go to court, and the court asks if you have signed the document, you're committing perjury if you say "no" (assuming you did sign it). It's the act that's important, rather than the resulting scribble.

I'm sorry, I don't understand. Well, I agree that it would be perjury. But then there would be no proof of perjury, and the perjurer would get away. That can't offer much assurance to the person accepting a signature. Besides, the argument applies to other signs of consent, like verbal consent. Suppose you give a verbal consent to an agreement and then renege. The other party drags you to court. The judge says, "Did…

Yes, exactly.

It only comes up if there's a dispute over whether the document was signed. Because the signature itself is so easily forged, the entire legal process relies on people not perjuring themselves if asked if they signed a document or not.

Re: The dubiousness of digitized signature services

#58

Post by marcus_holmes »

andreskytt wrote: post #17
marcus_holmes wrote: post #12

I've been looking into this whole area recently for a project. The problem isn't (only) the technical issues. As TFA points out, this is easy, and even the most naive and simplistic implementation beats physical signatures hands-down. There's two main problems: 1. Legality. Getting a court to recognise a digital signature probably isn't that hard. It's a bit like scanned images - if you can prove that this is the bes…

1 and 2 have been solved in EU

Someone needs to tell software companies then, because no-one appears to be following any standard.

Re: The dubiousness of digitized signature services

#59

Post by GordonS »

BlueTemplar wrote: post #48
GordonS wrote: post #42

Earlier quoted context omitted.

Something US-related instead of Japanese, is that cheques) or "checks" in US English) are still in common usage. I run a B2B micro-ISV, and the number of times I've been mailed checks, despite slapping "NO CHECKS ACCEPTED" on everything, is ridiculous.

I thought a business couldn't legally refuse checks, except for some places like supermarkets where there is a high risk of fraud?

I'm in the UK, where AFAIK we are free to accept whatever payment methods we like.

Re: The dubiousness of digitized signature services

#60

Post by quantified »

hedora wrote: post #20

I think this article misunderstands the purpose of signatures. The purpose of a signature is to inform the signer that they are entering a binding contract. It is simply the modern equivalent to a handshake. Sadly, precedent around Eula’s mean that signatures are no longer necessary to execute contracts. If anything, society would be better served by making it more difficult to enter into binding agreements than to m…

The purpose of the signature is to create an artifact that demonstrates the signatory’s acceptance. In a legal proceeding, the artifact can be produced as evidence. That is the purpose of all contract signatures.

If you have a contract that obliges something from me, and it’s not my signature, you may be attempting fraud on me. See bankers and robo-signing. That is why I need to see, on your copy, my signature and any other personalizing marks that my original document contains.

Post reply on HN