0

Assuming that you are not given any other choice than to implement digital handwritten signatures. That is, a signature pad (or even a computer mouse) is used to generate a digital signature which is stored as an image. The signature is part of an (authenticated) approval workflow. All users that are authenticated and authorised to view the approval can see the signature.

Since signatures are stored as images, when displayed in the browser, a signature can easily be copied without anyone noticing. What measures can one take to ensure signatures are not being copied by the other users?

Improve this question
4
  • Are you concerned about other people taking a screenshot of your signature and pasting it elsewhere?
    – pri
    Aug 12, 2021 at 9:47
  • potential duplicate: security.stackexchange.com/questions/235323/… in fact, nearly all of the questions using the tag physical-signature apply.
    – schroeder ♦
    Aug 12, 2021 at 9:49
  • @schroeder I agree that this may be a duplicate. However, I was not able to find an answer that includes the 3rd party witness aspect yet.
    – Just van der Veeken
    Aug 12, 2021 at 10:16
  • 1
    But you didn't ask about that. You asked about forgeries. And for that, this is a direct answer: security.stackexchange.com/questions/207640/… and the top answer talks about witnesses.
    – schroeder ♦
    Aug 12, 2021 at 10:35

1 Answer 1

Reset to default
2

A very short answer to this: you can't. And you shouldn't need to prevent this from happening.

A signature is simply a mark. It could be as simple as an X. It actually proves nothing and merely indicates that the "signer" processed the document. It can be argued that the handwritten signature is a memory aid for the signer to remember that they had signed it.

This is why legal documents include a witness to the signature. A 3rd party that can attest that the signer was the one who signed.

And this is the step that a digital workflow needs to include.

The signature/mark is never the point, but rather the 3rd party witness is. The system authenticates the signer and timestamps when the signer signs. In this way, it shouldn't matter if someone can copy the signature or whatever pretty picture someone draws on the digital pad (I know an infosec pro who signs everything as "Donald Duck").

"Digital signatures" (the cryptographic ones) offer more in terms of verification without user authentication at the time of signing and more portability outside of a company's systems, but that requires more of an infrastructure to handle that and to verify signatures. From what you've described, you seem to simply need an authentication step from your office systems when someone draws a pretty picture.

Improve this answer
5
  • Thank you for your response! Since the system authenticates the user already, is a 3rd party witness still required?
    – Just van der Veeken
    Aug 12, 2021 at 10:08
  • It depends on whether your system satisfies the requirements of a 3rd party witness.
    – schroeder ♦
    Aug 12, 2021 at 10:09
  • If you can draw an X on the pad, and you can then use the system to prove that you drew the X at that time and on that document, then yes. If you can insert images into the documents without authentication, then you run into challenges
    – schroeder ♦
    Aug 12, 2021 at 10:11
  • Very interesting. I guess this quickly leads to the discussion of what authentication methods are sufficient tot prove you drew the X. Any ideas on this?
    – Just van der Veeken
    Aug 12, 2021 at 10:15
  • It will depend on your systems and the level of trust that is required.
    – schroeder ♦
    Aug 12, 2021 at 10:27

Not the answer you're looking for? Browse other questions tagged .