Hacker News Reader

Comment by wizofaus | Hacker News Reader

It's a pretty terrible way to prevent tampering though - unless it has a digital signature (and all the necessary proof of signature authenticity via certificate authorities etc. etc.). Yet your average punter is far more likely to believe a PDF hasn't been tampered with than even a webpage hosted on a TLS-protected website. Word documents are not just proprietary* but for a high percentage of users by default open up in an editor designed precisely for "tampering", and certainly not for reading. There's definitely a need for a document format that serves the purpose PDF does now, I just wish PDF wasn't that format.

* sure, docx may be a form of OpenXML but it's still largely based around MS Word's proprietary behaviour - very few other tools can reliably display all docx files well.

View on HN

pdfs should certainly have more robust means to prevent tampering I agree. pdf integrity assurances aren't much better than ROT13 is for cryptography.

This is what PDF digital signatures are for. They allow you to make sure that the PDF hasn't been tempered with. However, that is not there original intention.

From what I remember the PDF standards groups are currently investigating adding something just for temper detection.

Being able to place a digital signature on PDF as proof that you've read it and, for contracts, e.g. as a way of indicating your acceptance of its terms etc. would be far better than the rather absurd method used now where you can just type in your name in some fancy cursive looking font and send it back as supposed proof of your acknowledgement.

The problem with digital signatures is that you need to have an appropriate certificate to do this. If the documents are only used internally, then some self-signed certificates or a company-internal certificate authority would be fine. But usually you want an official certificate.

And many certificate authorities sell such certificates but for high prices.

Typing in the name or signing with a touch screen is actually considered a valid and binding, official signature in most countries. It is the lowest form of a signature equivalent to a written signature.

Can you use LetsEncrypt or similar free services for certificates for PDF signing? Signing using a touch screen/ mouse/scanned-in written signature at least provides some small element of protection against forgery and proof of acknowledgment - typing gives you nothing really. And yet it's what I mostly end up doing because the alternatives are too cumbersome.

I don't think LetsEncrypt provides such a service. Additionally, the certificate must/should come from a CA that is included in the AATL (https://helpx.adobe.com/acrobat/kb/approved-trust-list1.html), otherwise you won't get the nice visual check mark that the signature is okay on Adobe Reader (and, let's face it, this is what most people are probably gonna be using on Windows).

Agreed on cumbersome, I have a PNG file with transparency containing my signature and use Xournal++ (https://xournalpp.github.io/) for placing it on the PDFs. That works fine but still takes more time than I want to spend. But it's faster than typing it out every time.

Reply on news.ycombinator.com