9

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified:

  • Is it a knowledge factor (something you know), in that you know how to write your signature (and someone else can learn it)?

  • Is it a possession factor (something you have), because it's physically encoded in the muscle memory in your brain cells and the way your hand holds a pen?

  • Is it an inherence factor (something you are), because the ability to produce it can't be taken away from you and it's (sort of) hard to change?

  • Funny, I think you're right about it being a biometric. But here's how it's better: If your signature is stolen, you can change it. When databases of fingerprints, vein and iris scans, etc start getting stolen, the biometric industry will have issues. – nowen Sep 9 '14 at 13:19
  • Depends on how you analyze it. If you do graphology, it could be a biometric factor (inherence). Otherwise it is a policy control, and doesn't fit the multi-factor paradigm. – Mark C. Wallace Sep 10 '14 at 11:50
7

I would consider a physical signature a biometric, albeit a pretty weak one. It isn't really something you have, since unlike a physical token, it cannot be stolen, or given to another (or, under most common circumstances, lost). It isn't really something you know either, even if an attacker knows exactly what your signature looks like, he cannot necessarily reproduce it.

The idea behind a signature is individuals have different idiosyncrasies in their handwriting that is relatively difficult to replicate. Unfortunately "relatively difficult" is very far from impossible.

Edit:

Some of the other answers to this question make a good point: Most of a time a signature isn't actually used as a for of authentication (in the usual security jargon sense). When it is used as an authentication factor, however, it would be a biometric.

  • 1
    ..I don't know about you guys, but I can't even reproduce my OWN signature identically every time. :D – k1DBLITZ Sep 9 '14 at 16:59
  • @k1DBLITZ Well, that is why I said "a pretty weak one". – lzam Sep 9 '14 at 17:02
  • 3
    @k1DBLITZ actually, encountering multiple instances of almost identical signatures is a signal that indicates risk of technically copied or otherwise forged signatures. If you simply sign stuff, then it'll have all kinds of minute variations, unlike 'drawing' or reproducing a signature, which skilled attackers actually are able to do. If your system has two documents where your signatures are completely identical, then most likely it's the same single signature that was somehow copied on another document, say, in Photoshop. – Peteris Sep 9 '14 at 23:05
  • @Peteris Certain tools (e.g. Adobe Acrobat) offer digital signing, in the non-cryptographic sense of using a digital tool to sign a document instead of printing it, hand-signing it, and scanning it back in. That also tends to produce identical signatures (since they just take your signature once, then reproduce it where you ask them to) – Nic Hartley Aug 16 at 18:58
6

The prime usage of signature is to signal intent.

Properly verifying if some signature A 'matches' some signature B is something that requires a lengthy and costly expertise and generally isn't done outside of significant court cases, so in most cases it actually doesn't function as authentication factor at all. For example, when accepting credit cards at a point-of-sale terminal, employees are often instructed to accept any (non-empty) signature as matching any other signature. Check verification does include some signature verification and can catch low quality forgeries; in this case it's "something you know... but distribute occasionally" as the forger has to have access to some samples of your signature in order to make a suitable replica; but doesn't need any access to you personally for this attack (so not 'something you are').

However, the signature indicates your acceptance and intent of the transaction - the general authentication is performed through other factors, but only your signature indicates that you authorize the deal as opposed to simply being present.

2

It's not a factor at all because a signature is not primarily an authentication mechanism. In a credit card transaction the possession of the physical card is used for authentication.

A signature is primarily used to ensure there is no ambiguity about the intent of the person using the card. For example:

  • A signature ensures there is no misunderstanding between the vendor and the cardholder about whether they intended for a transaction to take place.
  • If a card is used fraudulently then there can be no doubt that the perpetrator did so with fraudulent intent and not by accident.

This is why stores commonly ask to see photo ID, so they can check to ensure the name matches and the photo on the ID matches. In effect they are authenticating you using something you have (the card) and something you are (your appearance) but the signature rarely plays a part in the actual authentication process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.