65

Why are hand-written signatures still so commonly used? Can they actually prove anything?

Two assumptions:

  • If anyone wants to forge my signature I'm sure they will be able to do it. Even my own signature looks a little bit different every time I sign a document.
  • If I commit to an agreement by signing a contract not with my typical signature but using a new random signature (maybe even using my left hand), I could just claim I didn't sign it and the best forensics will probably have to agree, because my "real" signature is completely different.

On the other hand, why are digital signatures not more popular? Just because non-tech savvy people don't know how to use them?

Improve this question
6
  • 17
    Humorously related: Whenever I'm asked for a signature from a credit-card swiping machine, I usually just draw animals or faces. Once I even scribbled to fill every pixel on the screen. No matter what I do, after several seconds it always comes back with "Signature accepted."
    – BlueRaja - Danny Pflughoeft
    Oct 15, 2011 at 20:34
  • 1
    I will have to try this: consumerist.com/2009/02/…
    – BlueRaja - Danny Pflughoeft
    Oct 16, 2011 at 5:16
  • 2
    Don't think that it's really easy to forge signatures. And yes, even if your signature seems to be different everytime you sign, you leave some traces on it that are very peculiar to your way of signing
    – woliveirajr
    Oct 17, 2011 at 17:10
  • 4
    This is definitely on topic as far as I am concerned.
    – Stuart Woodward
    Oct 18, 2011 at 3:12
  • 15
    In Japan signatures are rarely used. Instead, every adult has multiple seal/stamps (hanko) which are used to stamp documents in the same way as a signature is used. Someone possessing your seal can stamp your name as your proxy. Stamps that were used for important transactions like buying a house or getting married are usually locked away in a secure place. Local governments have a register of seals & issue certificates of authenticity. They keep an image of the registered seal electronically and can verify whether a seal is the same one that was registered at another location in the country.
    – Stuart Woodward
    Oct 18, 2011 at 3:23

3 Answers 3

Reset to default
48

It pays to investigate what we really trust in hand-written signatures.

A signature is the physical manifestation of the will of the signer to acknowledge the contents of what is signed. Most legal systems define that a signature is yours and is binding if and only if "you really did it". This looks like a tautology, but it actually is quite profound: the hardness of forging, or even the involvement of a physical hand and pen, are not part of what defines a signature.

So what's the trick ? At the core of the trust system is the set of laws which severely punish forgery: forging an hand-written signature is an offense which can land you in jail for much more time than whatever you signed. The idea is that a hand-written signature happens "in the physical world" where it leaves many traces, in particular witnesses. The risk of being caught forging a signature makes it "not worth it". The signature medium is not really important; typing your name at the end of an email is as much binding as an ink-based handcrafted smudge at the bottom of a piece of paper (at least in England; there are variations depending on the country). In Japan they use personalized stamps.

The system works as long as forging signatures remains risky. When translating into the digital world, signatures become too easy to forge without any trace, which is why cryptography must be invoked. Cryptographic signatures also open the possibility of automation: being able to sign and verify at lightning speed (the verifying part is a novelty: with hand-written signatures, verification that the signature is legit is not a power given to just anybody).

The hard part of designing a signature scheme remains the set of laws which make the link between the action of signing, and the legal consequences thereof (namely, the "binding" part). Technicalities such as length of a RSA key are the easy part, which can be done by mere scientists -- but laws take decades and an awful lot of negotiation. Such laws exist for hand-written signatures; actually, they have existed for thousands of years. Digital signatures will begin to compete with hand-written signatures only when legal systems will be up to it. Europe is currently trying to do that, but it takes time.

Improve this answer
4
  • 1
    "verification that the signature is legit is not a power given to anybody" - notaries public can of course verify the signature and the signed document.
    – user185
    Oct 17, 2011 at 14:31
  • @Graham: well, even notaries tend to require witnessing the act of signing. Checking an handwritten signature after it was done requires comparing it with samples of the "correct" signature, and only an expert at graphonomics will provide any real robustness against most forgers.
    – Thomas Pornin
    Oct 18, 2011 at 14:17
  • I'm pretty sure you don't generally need a digital signature in order to hold up in court. In the US, court documents are routinely signed as "/s/ Full Name." Things might change if someone claims it's a forgery, but that's rare and allows other evidence to be introduced to show that it's not.
    – cpast
    Apr 29, 2015 at 18:10
  • Signing a document doesn't only show that you acknowledge it, it also shows that you are willing to enter into a binding legal agreement. I read somewhere requiring a signature is about solemnization than authentication.
    – bdsl
    Jun 30, 2015 at 11:51
1

Because the legal system is very slow to catch up with the "latest" technologies (asymmetric cryptography was discovered in 1978). Also, people manifest some inertia when it comes to trust, especially for technological things.

The best we could do is to append the hash of the pdf form of the same document at the end of said paper document, and let the signer sign it. This way, on court, it would be possible to prove that the signer signed that document (well, at least the pdf form of it)

Of course, a digital signature creates another problem: identification. We need a reliable way of matching a given private key (which is personal and confidential) to its owner. The government could link the two but it would constitute a single point of failure prone to attacks

Improve this answer
0

Well, ever wonder where the web of trust model came from? Look no further than notaries.

In any case, not everyone wants to remember a huge chunk of non comprehensible strings, apply them as rounds in some kind of XOR blocks and be able to compute the ciphertext in the amount of time it takes to do a john hancock.

Improve this answer
1
  • 4
    Notaries are actually not a web of trust, but a hierarchical system: you have a trust root (i.e. the government), which certifies notaries, which verify signatures. In WoT everyone decides for themselves who to trust to verify a certificate; with notaries, only the government can decide if someone's a notary or not.
    – cpast
    Feb 7, 2015 at 5:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .