Comment by lucb1e | Hacker News Reader

Comment by lucb1e | Hacker News Reader

The title sounded very promising. The "proof of identity" system we use in the "non-web" is very crude: Handwritten signatures are about the cheapest and most easily forged type of authentication you can think of, and yet they are (combined with your full name), usually legally valid and binding. A picture of someone holding up a purse with his driver's licence, back of a debit card, passport or identity card is all it takes.

But it turns out they mean "non-web" as in "ssh, imap, etc."

I keep waiting for someone to come up with something better than handwritten signatures; a (H)MAC of some sorts seems the way to go. It just doesn't come... And yes, I've also tried to devise my own system to cryptographically sign documents, but it's not practical yet. Basically you're converting the document to a digital format before generating a 128-bit signature (that you can then put on the paper as 16 Unicode characters), which is not really ideal.

I'm pretty sure that in most places, your signature is only legally binding when you are the one that signed it. It doesn't particularly provide authentication, but in cases of fraud it provides some evidence of intent.

Of course, but the signature is the proof that you are the one that signed it.

Im not sure how a signature could prove who signed it. Handwriting analysis can tell some things, but how many people still sign enough of a name to actually analyze. Look at the [Jack Lew signature](http://www.google.com/imgres?imgurl=http://images.politico.c...), assume that doesn't tell anyone much about _who_ signed it.

I don't think it is used that way very often.

Besides on every exam I've attended (school and for driver's license), and pretty much everywhere else where I had to prove my identity.

So for how many of your school exams do you think someone actually authenticated your signature? If it is never checked, it is reasonable to argue that it isn't being used to verify anything. Also, on things like exams, it is being used to encourage the test takers to take the honesty pledge seriously (and again, if someone signs a wrong name, it shows deceitful intent).

Identity is much more slippery than you are making it out to be. A signature doesn't prove it. An authentic government document doesn't prove it (it just verifies that you went through that particular identity verfication process).

Reply on news.ycombinator.com