|
Problems With Digital Signatures
---===---
OSAll Contributor
Right now thereīs only one way to "positively" identify yourself on the Web -- a certificate (most likely issued by Verisign). Utah already considers these certificates to be acceptable for legally binding signatures and New York is closely following. The problem is that thereīs no identity verification involved when a certificate is issued.
A print signature has precedence -- thereīs always going to be a set of original signatures to be examined. These signatures can be "known good." The problem with a digital signature is that theyīre so easy to get -- and thereīs no precedence to compare them to.
In order to get a working digital certificate from Verisign, the top vendor of these products, you need two things: an e-mail address you have access to and a credit card number. These two things are very easy to have access to. I can relatively easily get access to your e-mail account (it really isnīt that hard). Furthermore, itīs not entirely difficult to get your credit card number (receipts, sniffed transmissions, phone, etc).
Take this scenario: I (person A) want to impersonate you (person B) on the Web. I go to Verisign and sign up for a certificate saying Iīm you. I give your e-mail address (Iīve already compromised your account) and your credit card number (I went dumpster diving behind your house). I now have your digital signature -- and equally importantly, you donīt.
Presumably when the Verisign charge (ten dollars per year) shows up on your bill, youīd call up the bank and say that this charge isnīt correct. At that point, presumably, the digital certificate would be pulled (Iīve tried this as a test -- the certificate isnīt always pulled). A credit card number simply isnīt enough verification.
So what can be used as a digital signature? Right now, thereīs no way short of actual physical content to verify an identity. If certificates were to be issued only after a "real" signature was used to verify them, then there would be a chance.
Granted, a falsified signature probably wouldnīt hold up in court. But what about the other implications? How about secure communications sent to person A instead of person B? The implications are indeed rather large.
Unless Verisign or a similiar company establishes physical checks there will never be a truly solid identity on the Web. Thereīs simply no purely remote way to identify someone (short of biometrics, but that would be considered an invasion of privacy and is several years in the future anyway).
The short? Get a certificate -- itīs a good idea. But donīt rely on other peopleīs certificates. |
