Comment by ThrownOffGame | Hacker News Reader

Comment by ThrownOffGame | Hacker News Reader

The crazy thing about the "paperless office" of the 21st century is that authentication of documents has gone out the window, completely back to the stone age of forgeries.

Didn't we recently see where a landlord attempted to forge a lease document but was caught by the tenant?

Nobody wants to see your authentic ID/DL anymore. Just FAX it in or scan it. Nobody can examine your birth certificate or passport (except for real officials) but you need to scan and present it to all kinds of third parties. It absolutely destroys 80% of the countermeasures that are built in to those types of documents. Wrote a check from your checkbook? Your bank immediately photographs it and the image traverses their network, not the paper thing. They just shred that useless paper thing. The image is, for all intents and purposes, the negotiable document. Most of us pay a premium for "security checks" with a bunch of microprinting and other bullshit. That's utterly useless once you push it through a cellphone cam!

I've drawn a lot of public assistance from entitlements. They often require a stack of paperwork, like bank statements, paystubs. I usually ran Linux and had all the third-party PDF-manipulation tools. They would just accept screenshots from my banking apps! I could've easily forged anything, down to pixel level, or in the HTML itself, print to PDF, undetectable. No checksums or hashes to worry about!

So perhaps this headline is a symptom, a symptom of landlords being skeptical and wary of tenant-side forgeries, that they feel the need to grab the documents straight from the horse's mouth. I can't blame them for being risk-averse and wary of forgery, but this is crazy. Just... figure out a way to authenticate electronic documents. We cryptographers have worked this all out, but it's been ignored for reasons of cost and expedience. You can't ignore it anymore.

In India, a person can repudiate or U-turn his spoken words too easily but a forged screenshot shows intention to cheat and is a much more serious matter. So screenshots are taken as truth.

Yes, people do earn their rightful reputations as truthful or two-faced, but in many contexts two-faced is considered default.

> but in many contexts two-faced is considered default.

How is it possible to do anything, in that case?

> Most of us pay a premium for "security checks" with a bunch of microprinting and other bullshit. That's utterly useless once you push it through a cellphone cam!

If I recall correctly, you can order checks from a check printing company with any account and routing number you specify. Walmart sells them, and it was cheaper than getting more from my bank. So even an authentic check with the security features intact doesn't seem worth much. The only real security feature is the signature.

Sure, I could order plain "insecure" checks, but those aren't the one I'm depositing by image. My checks are written to others and I've got no idea how they deposit them.

I've received checks with watermarks, temp-sensitive ink, you name it, and I almost never walk into a branch anymore. As long as the mobile app works, the image is the negotiable instrument, and I can't change what others give me.

I think they’re saying anyone could order “secure” checks with your account number on them.

That is certainly an attack vector of concern! I've had friends where the attacker just exfiltrated a single check from their own checkbook and cashed it as legitimate somewhere else!

It seems that a third-party check printing service could run off checks for the attacker instead. The attacker would need to cover their tracks insofar as payment methods, and then intercept a package which would be mailed to my home address listed on the checks they ordered. That seems elaborate, but doable, if they want a whole stack of legitimate checks.

It is possible that there are even disreputable "security check" printers who aren't Walmart, but just counterfeiters in a 1BR, running off bogus checks for anyone who asks?

But who needs/wants a whole stack of them, anyway? It only takes one or two.

It is so strange, too, that we rarely hear of check fraud in the States. It would seem so easy, so is it widespread or rare?

Reply on news.ycombinator.com