Hacker News Reader

Comment by phyzome | Hacker News Reader

Sounds like there's pretty clear evidence present on the RightSignature site, but they really need to provide a way to verify a document without the site being up and intact. That certification page is basically worthless otherwise.

View on HN

It's difficult, because the certification page is part of the PDF so obviously can't include a hash or signature of itself. And you can't just rely on a hash since someone could tamper with the file and just update the hash. A well defined way to extract the signed payload would work, but their design doesn't currently involve any cryptography so it would be a pretty wholescale redesign.

The PDF format supports this, at least Adobe Reader can validate a signed PDF if it's signed in a certain way[1]. I know DocuSign does this - and Reader even has a little button to view the signed version (embedded in the PDF, I think)[2]. [1]: https://helpx.adobe.com/acrobat/desktop/e-sign-documents/man... [2]: Example in Adobe Reader: https://i.moveything.com/1cf1e4ea5619 (redacted partly by me)

Signing PDFs digitally is kind of a pain, though. There are several different standards, compatible with different readers, and you need to pay up to get a trusted certificate or Adobe will stick a huge "THIS DOCUMENT WAS SIGNED BY AN UNKNOWN PARTY" banner across the screen when you open it. And then you need to opt into the services of a timestamp server to validate your signature or your document might be marked untrusted when your certificate expires.

It's a better technical solution but unfortunately it's not as simple as you'd hope it to be.

Yes it is not perfect. At least in Lithuania you can use government issued personal ID to sign PDFs that pass Adobe/Foxit checks of signature authenticity. Trusted timestamp is part of a valid signature as it allows to check validity of signee certificate at the time of signing.

Adobe says: Source of Trust obtained from European Union Trusted Lists (EUTL). This is a Qualified Electronic Signature according to EU Regulation 910/2014.

Foxit says: Source of Trust obtained from European Union Trusted Lists (EUTL). This is a Qualified Electronic Signature according to EU Regulation 910/2014.

I remember a case in a different jurisdiction where a judge dismissed a digitally signed document with an argument they aren't a party of PKI system and don't have a key, so they can't do anything. This stuff is weird.

Reply on news.ycombinator.com