the one benefit i see is as a final “lock in your answer” function for any form you’re submitting.
And did they have to stop allowing written signatures because of AI scraping? Or is it just because they never looked legible at all?
Had my identity stolen. Thief bought a car with a loan they got online. Forged my signature at the dealer half a country away. I hired a lawyer because BofA are fucking criminals.
Me: “This is clearly not my signature on this document. Doesn’t that mean anything?”
Lawyer: “Nope. Not a thing.”
WTF.
Now anything asking for my signature is squiggles unrelated to the written language.
Obligatory “bofa deez nuts”
What else happened?
Went to court. Judge ruled in my favor. In the meantime I had contacted the Consumer Protection Bureau (US). Back when they had teeth and funding. BofA must have had a whole department that dealt with CPB because that shit got resolved quick. Took more than two months and around $1500 to get it cleaned up.
My credit is locked at all three agencies now. Highly recommend everyone do it. The fact it isn’t locked by default is asenine.
Proper digital signatures are very secure and prove that you have possession of the signing key and that the document has not been modified since. Unfortunately those keys are very expensive (unless your employer gets them for you), so usually when people sign something in Acrobat or whatever it will just use a self-signed certificate at best. This does still prove that the document hasn’t been modified since it was signed, but it doesn’t prove anything about who signed it.
Digital signatures are much more than “just typing your name in a box”. The few times I digitally signed a doc I didn’t even have to do that, just click on a big green button.
It’s all connected to how you authenticated before you got to that point.
I think @mentaledge@sopuli.xyz explained it well.
The digital signature is things you don’t see. The visual signature is more for ceremony as it’s referring to our past to smooth the transition
You might be confusing this with a browser fingerprint. There isn’t a magic ghost signature that appears in the data when you consent to sign by typing your name in to a box. It’s really just the box.
It does as much as does “testifying under oath” does to magically stop you from lying.
i.e., putting your hand on a significant bit of text and saying some special words doesn’t stop you from lying, but it DOES create / enhance penalties if you do.
The visual signature part of a “digital signature” is purely cosmetic. The actual signature is the entire file being cryptographically signed using a private key you possess, which any recipient can then verify came from you by using a public key.
This is the case for all government issue signatures (like when using the private key inside a chipped government id card) or any other signature created using a key pair from a issuing authority.
If its not a digital signature in this way, the other way is literally just an image. It can be a vector or an raster, or a straight up scan of a physically signed document. It’s just a picture. It has no digital verification whatsoever.
the other way is literally just an image (of your signature)
I’ve done that a few times, in GIMP (or Photoshop), and was always a little surprised that it seemed to be enough. Maybe I unwittingly “forged” my own signature? That’s legally murky…
It’s really just a digital way to do the equivalent of printing the document, signing it, and scanning it again. Which is also accepted in a lot of situations.
deleted by creator
What? No it’s not. This whole comment is wrong, sorry.
When a website has you type a name as a signature it’s a legal representation of that signature. There’s nothing cryptographic at all about it. In the US this is regulated by the ESIGN Act (https://uscode.house.gov/view.xhtml?path=%2Fprelim%40title15%2Fchapter96&edition=prelim). Also, where would you even store the key? I’ve made ways to use Webauthn keys to do this, but no signatory uses these methods.
And that’s not how ZKPs in government IDs work, either. You never sign with them, you only verify.
Ref: My job is cryptographic signature protocols, and I have a draft at IETF for one of them.
When a website has you type a name as a signature it’s a legal representation of that signature. There’s nothing cryptographic at all about it. Wjere would you even store the key? I’ve made ways to use Webauthn keys to do this, but no signatory uses these methods.
I claimed no such thing. That is not a digital signature.
I’m fairly certain we are not discussing the same thing.
I can digitally sign documents the way I have described, NOT IN A WEB BROWSER, using entirely local or even open source software, using my government issued ID card.
The solution provided for electronic signatures by the Digital and Population Data Services Agency is a signature certificate. The certificate is located in the card chip.
As described by the relevant finnish agency, this is enabled by a “signature certificate” stored on peoples ID cards. The functionality uses a separate PIN from that which you use to verify your identity in the context of a website you are visiting.
I am not aware of any other way for me to sign a document in such a way. All the other signatures, which do also work, are something else. And potentially insecure in all the ways OP thinks. (Someone else can type the same name).
I claimed no such thing. That is not a digital signature
But that’s what OP is describing with the “”'s, so I assumed you were responding to the question, which they may have as well.
The functionality uses a separate PIN from that which you use to verify your identity in the context of a website you are visiting.
Interesting, I hadn’t realized Finland added a separate cert from the ZKP ( https://www.suomi.fi/services/citizen-certificate-digital-and-population-data-services-agency/dc540ff4-0030-46b2-add0-9f7ceb2a41c8), new info gleaned.
Though this may still be “slightly” off. Seems the finish ID is a standard Zero Knowledge Proof (ZKP) plus a pin activated signature (Citizen) certificate.
This should mean you can identify yourself, or that you are over 18 without revealing your full identity) without the PIN, as that operates separately from the signing certificate which can be activated independently. The PIN would be used for signatures or encrypting things. Very cool.
Surely they’re talking about the likes of DocuSign, which doesn’t involve any user-controlled keys
The only private key with docusign is the fact you has access to the email inbox. And it’s not even a private key, just a symmetric key in the link of the email. They might do some basic user agent and IP checks for suspicious activity, but if someone you know has access to your email DocuSign wouldn’t know the difference
🤯
Well that explains everything. Thank you very much!
That didn’t quite explain everything. I want to add that there are “type your name to sign” forms that are just what you described, just bytes spelling out your name. In those cases, you’re right, those bytes don’t have your handwriting to prove anything, but they do accomplish something. If the form is secured behind a login and not a totally buggy heap of garbage, then the act of typing your name on that form demonstrates that whoever logged in deliberately expressed their approval. And whatever level of identity verification is needed for login is then playing the part of demonstrating who did that. That’s not perfect, but the level of evidence might match the level of risk enough to justify that mechanism to the company providing it, and it’s important to consider all factors: not just system cost, but end user tolerance.
E.g., there was (maybe still is?) a “ham” radio logging system that had end users generate their own PGP signing key pair to sign their log books, which are simply a list of who they talked to over the radio, always for non-commercial purposes (by law). Many questioned whether a secure web site with good 2FA might suffice and be much more convenient, manageable, and adequate risk level for most users.
“Digital signature” is a proper term that should mean what the parent comment explained–public key crypto “signing” (a hash of) a document’s content–but “sign here by typing your name” will inevitably get called a signature and, obviously, is also digital, just not a real “digital signature”.
Thank you, I was definitely thinking of the first paragraph but the context of third paragraph (and MentalEdge’s comment) helps me to understand why that system actually works/is considered good enough.
In the US, they don’t do the cryptographic signatures, they do the image. There are document signing services where you just type your name and it creates a “handwritten” signature from that name and that’s legally binding apparently.
I found it very funny when I had to sign a contract with an American company that way. Not sure it would’ve been legally binding in my jurisdiction, but the contracts was more or less “don’t tell anyone about exact details of the sizable bonus you’re about to receive, or we’ll revoke it, also you’ll have to stick around for half a year to receive the other half”, when the company got sold to private equity and the original owners decided to give us all something to remember them by.
I think that’s probably it, or pure cargo cult because “we’ve always had signatures so something’s got to go in that slot”. The whole idea of random scrawls for “authentication” has been weird all along. As if everyone walked around knowing what everyone’s signatures should look like. And if you do know, you can just… write it that way.
(Plenty of countries just have digital “signing” that’s a bit more like something sane, a central authentication thing based on your ID number and 2FA.)
financial institutions had your signature on file and would compare it back in the day. It made sense at one point but it does not gel well once making copies and images of everything became commonplace.
Remember back in the day when you used to have to sign the back of your credit card.
I would write in that block “ASK TO SEE ID”. At least 100 cashiers would read that and then just stare at me.
Yeah. That’s because nobody cares.
We just wanted to get through the line, we don’t care who’s paying your tab.
Absolutely!
then like the post office says they won’t take it unless there is a sig so I have to write see id and have a sig which of course my id has a sig.
Your signature can be whatever you want to sign. I sign different things all the time. The legality is just in you consenting and making your mark.
Your signature looks different every time you sign it, and it being an exact replica was a way to spot a forgery. A signature has never been some sort of security feature.
Where have “they” stopped allowing written signatures?
The truth is, wet signatures have been absolutely worthless for … well forever. The first time I had a credit card was in the late 80s and even back then it didn’t make any sense that I was signing receipts in the grocery store.
I scanned the responses, and didn’t see anyone who mentioned this.
The point at which the U.S. allowed you to “sign” your name by typing was when the E-Sign Act was passed. That was in 2000, long before LLMs were really a concern.
The reason was to make online commerce easier. Verbal contacts could and continue to be enforced, but enforcement requires more effort than with a written contact.
At the time I thought the law was passed by people who didn’t understand technology and how easy this made it for people to commit fraud or screw over consumers. However now I realize they just didn’t give a fuck.
Signature matching/analysis isn’t particularly scientific, so in general a physical signature is used for clear authorization, not identification. When you log in to something to sign your identity is already set by other means, so all the signature needs to do is say “yes, I agree to this”. E signatures in the US were legally formalized awhile ago, so it’s not really a controversy.
physical signatures are just asking you to write your name in a box…
Not a huge difference.
No I disagree, the idea with physical signatures is that you write it in cursive, so in theory nobody will do ot exactly the same way as you write it - but then people can forge things, and since people don’t actually write their name the exact same way every time, forgery is essentially as good as perfect.
Edit to fix typo and add italics.
In parts of the world, paperwork is managed with stamps and a mark. Your doctor in latin america will stamp a blank prescription pad with a stamp that has their name and license number. They will then make a recognizable mark over the stamp. Same with your lawyer and all government offices. The point isn’t that someone can use handwriting analysis - which is just fluff - and rather that they possess the stamp and those who would read the paperwork recognize their particular mark.
You might disagree, but that doesn’t mean you’re right. A signature does not require cursive. It doesn’t even have to be legible. It’s a mark that you make signifying that you agree to whatever it is you’re signing.
https://thelegalguide.org/understanding-signatures-legal-definitions-validity/
Could be a jurisdiction thing. Non-cursive signatures* get rejected in my country if the recipient bothers to check.
( * If written in the Latin alphabet.)
And, most young adults don’t sign in cursive anymore, so, aside from terrible handwriting, their printed name isn’t really much different than a typed name.
most young adults don’t sign in cursive anymore
That seems like a terrible idea. I’m disappointed in humans yet again.
Sure, some people who practice their signature and do it consistently can have theirs tested for consistency but forgery is a thing. I have never had a consistent signature in five decades which confirms the whole ‘unique signature’ thing is bullshit.
The whole point is just having something that holds up for the legal system, and a lot of bullshit does.
I have never had a consistent signature in five decades which confirms the whole ‘unique signature’ thing is bullshit.
Valid.
Having a robotic copy+paste signature probably only starts being useful if you’re known to have huge amounts of cash in the bank or you’re an artist, or have a troublesome bart simpson-esque kid.
How’s your cuneiform? Do you know how to use a quill pen? Do you know how to bleach a peace of expensive parchment so that it can be reused?
How’s your cuneiform
Yeaaaaah wtf are you talking about lad. That is an alphabet, i.e of a foreign language, not the act of being able to write my own name in cursive in my native Latin script.
Do you know how to use a quill pen?
Yes. Why do you not know how to?
Do you know how to bleach a peace of expensive parchment so that it can be reused?
I could probably figure out how to bleach a piece of parchment in order to re-use it, but have never had to.
Have a nice day.
Meh. After hearing years of complaints from old people about how terrible young people are, and working with a lot of young people who are objectively much better people than the old ones that complain about them, I always try to stop to think about why traditions are valuable.
Does writing your words with extra loopy bits that are less legible than print REALLY make you a better person?
Not learning cursive is like not learning Latin. Maybe it was useful at some point, but the only reason to push for it now, is because “That’s how I did it, so it must be the best way, and everyone else is wrong!”
On the flip side, there’s validity in doing things just for the aesthetics of it and we sacrifice too much to the ever present drive for efficiency.
Cursive isn’t necessarily the banner we should all rally behind for that though handwriting something is still shown as one of the best ways to remember something.
As a fan of fountain pens and handwritten letters it is nice to get one knowing someone put that effort into it.
I dunno where I’m going with any of this. Teachers and schools are underfunded, if kids are fucked it’s our fault don’t blame them, fancy squiggles are fun.
not learning cursive is like not learning Latin
I think both are still useful today, cursive less so. But sure, they’re not indicative of superior moral fibre, which is presumably why you prefer young people to old people.
To put a finer point on it, it’s not even just “moral fibre”. Sure, higher societal morality is something we should all strive for, but I’m not even asking for that much.
It’s the morally neutral bullshit like handwriting, or reading a novel on your phone instead of on paper, or spending your free time playing video games or watching YouTube/Twitch as opposed to watching Network television. There’s no reason to raise a fuss or dub others inferior for doing things a little different.
I’m not raising a fuss, but signing in detachéd does make it way easier for others to forge your signature and even makes it less difficult to replicate your own signature. Knowing how to write cursive costs nothing, so not practicing it - at least for signatures - seems terrible.
It lets you sign off greeting cards (more effectively)
It leads to faster note taking (though generally less neat notes, lol)
I think there’s validity in learning/teaching cursive, if you’re proficient it’s a much faster way of writing. Handwritten notetaking has been shown to be more effective than digital in terms of concept retention (you’re not just regurgitating content verbatim), and cursive can facilitate better notetaking. I’d argue its setting students up for better outcomes in secondary and post-secondary institutions.
Regardless of that I do agree with your view, we should not just continue things for the sake of tradition, young people aren’t “terrible” for forsaking certain traditions. If anything, re-evaluating what we hold as important is a useful exercise, especially when it comes to education.
Reading through these comments and I’m just now realizing something; I’ve never gone searching to see data on if cursive actually is faster on average and if so, how much. And does that handwriting improves memory fact apply more to cursive or print writing or equally just because it uses more muscles in general?
I’d imagine it would partially depend on the script chosen, ligature vs looped, Spencerian vs New American vs D’nealian etc for speed but the memory thing I’ve got no guess.
Why? Everyone’s handwriting is different and unique whether it’s cursive or regular script.
Signatures have never required cursive. Historically, people who couldn’t read or write would just put an X in the signature spot and that was valid. Yeah, there is a marginal benefit to physically signing something in cursive, but the purpose of signing it has always been more of a final agreement step.
If handwriting and spelling and how I signed it actually mattered at all legally, then I could sign a different name when I buy a car, get keys, drive away, and later in court, say “well I never agreed to pay for this car, look at my signature, it says Frank Sinatra”. Same goes for a true forgery. The evidence I didn’t sign it myself is my statement in court saying “I didn’t sign this”, and whatever signs there are that I didn’t benefit from this.
Where I come from the X thing wouldn’t be legally binding. What people who couldn’t read or write would do is using their fingerprints. They would put their finger on a stamp ink pad and then stamp the paper with their finger. That’s why we say “someone who uses their fingerprint” as a euphemism for “illiterate”.
That’s really interesting and a great way to do that, honestly. A singular fingerprint also makes more sense than needing handwriting analysis to detect a forgery, too. Kinda feel that should be the norm everywhere, honestly, a signing and a print next to it to verify against if the need arises.
So your last paragraph is a bit off. One it was generally checked with your id that the names were the same. I often had to sign a non typical signature because of a place that required the full name. then also signing someone elses name on a document would be something they can go after you for. Im not sure which all laws but you can’t pretend to be someone you are not with contracts and agreements and such.
I was still speaking historically, so I meant before easy checks like your ID were in place. Its definitely harder to do that, nowadays. But of course they can go after you for it, that’s my point. You’ve agreed to a contract by the act of signing anything. If I forge a name of a nonexistent person, they can still go after me as if I’d signed it normally, because the act of signing at all is what binds me, not what I actually sign. I held the pen, I agreed to the contract. It would be ridiculous to escape legal consequences by doing things like signing differently, and in this area of law, at least in the US, common sense prevailed and I’ll be liable for whatever I willingly signed, whether that’s my name, an X, a fingerprint, a fake name, or anything else.
Nobody has relied only on signatures to verify that a person signed it, since forever. Especially because forgery was always a thing.
This is why documents that are important aren’t just signed by one person; they’re signed by witnesses who presumably will vouch for it. (Like notary public’s are a thing.)
For lesser contracts they first verify you are in fact you.
There’s no functional difference online- to within a reasonable standard.
Yeah, no.
I wanted to withdraw some money from my investment portfolio in bank, and the teller denied my request multiple times because of mismatching signature. Then they told me to change my stored signature, which took additional 10 minutes.
Like how in the fuck does any of that make sense. It needs to be same, but I can change it regardless, so what was achieved.
I never use handwriting, my signature isn’t even 60% same between any 2 attempts.
This is not universal. Many don’t proactively check, the signature is typically used afterwards when the account owner makes a claim that some action was fraudulent. Some businesses will check to avoid precisely dealing with those claims, but most don’t have to.
And also, legally the mark can be anything and it’s just a convention that it is your name.
So how did they know you were you?
They allowed you to update the signature. They may have been oddly fixated on the signatures matching, but they still verified your identity in some other way.
Or they’re idiots who shouldn’t be in control of other people’s money,
“in cursive”
Laughs in years of deviating but programmed hand movements from which letters are rarely decipherable…
IMO, that’s not a digital signature. That’s a normal signature on a computer. Digital signatures involve cryptography. For example, OpenPGP.
