On 08/05/2015 09:28 PM, Carlos E. R. wrote:

...

...

It looks to me as if this is piss poor security; anyone could download the PDF form from the web, fill it in, use any signature that looked like an scrawl beginning with an A-she and ending with a D-shape and any phone number then fax it back, all leaving me completely ignorant. Absolutely.

Later, you could contest it in court.

If I ever knew about it. if it had not stripped me of the assets I needed to contest it. If ... if .. if. I can think of scenarios where assets have been stripped or the person in question seems to have agreed to something like "voluntary commencement" to psychiatric rehabilitation. A form of identity theft in practice. -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/05/2015 09:57 PM, Billie Walsh wrote:

Print the form. Sign it with a pen. Scan it with Scan2PDF back into a PDF. Send it back to them. Problem solved.

We do it all the time with contracts for the TV station.

Like with the scanner built into the "all purpose" printer, which also has FAX capability ...? no, the idea was to eliminate paper copy all together. -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/05/2015 10:41 PM, greg.freemyer@gmail.com wrote:

On August 5, 2015 10:07:28 PM EDT, Anton Aylward wrote:

...

On 08/05/2015 09:57 PM, Billie Walsh wrote:

...

Print the form. Sign it with a pen. Scan it with Scan2PDF back into a PDF. Send it back to them. Problem solved.

We do it all the time with contracts for the TV station.

Like with the scanner built into the "all purpose" printer, which also has FAX capability ...?

You have a land line? I only have cell phones, so the fax is inop. :(

I have a VoIP service. I don't know if it will work with FAX. I haven't had a fax machine. ever. Once I loaded fax software on my laptop ... what about 20 years ago, and dill have a Bell line back then. I never got it to work right and had little use for it anyway. I think it must be about a decade since I last sent a fax. -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2015-08-06 13:46, Anton Aylward wrote:

I have a VoIP service. I don't know if it will work with FAX. I haven't had a fax machine. ever.

Some time ago I looked at asterisk and faxing, but only in theory, I had no chance to try it. Googling I just found a document: http://www.voip-info.org/wiki/view/Asterisk+fax «Across the Internet even a G.711 codec fax transmission is unpredictable. An excellent discussion of why faxing and modems don't work well over VoIP can be found here. However, people often get perfectly good results on lightly loaded LANs. It still isn't perfect, as a burst of data on the LAN can still upset things, but some people get results they can live with.» That "here" is : http://www.soft-switch.org/foip.html Faxing over IP networks «FAXing over VoIP networks doesn't work. You can sometimes arrange things so a fairly high percentage of FAXes get through OK. You can occassionally create setups that work 100% of the time. These are rare and unrepeatable setups. You need to use a proper FAX over IP protocol, such as T.38, to achieve consistent reliable FAXing across IP networks.» ... «Sending FAXes over VoIP networks usually fails. It is human nature to look for simple reasons for that, and simple cures. In reality, there are a number of reasons, and no certain universal cures. VoIP networks are designed to do a good job with speech. Carrying any sound other than a single voice speaking is not generally a system requirement. It shouldn't be too surprising if it works rather poorly.» The documents discuss how to do it, but setting up an asterisk server (plus hardware) is not trivial. You rather need access to a gateway service. Have a look in the second doc to the paragraphs after «FAX over IP (FoIP) specifications» «T.37 defines a procedure for receiving a FAX at a gateway; making an e-mail message, containing the FAX as an attachment; sending it to a remote gateway; and dialing out and delivering it from the remote gateway to the destination machine. It might optionally be delivered as an e-mail with a FAX attachment directly to the recipient's e-mail box. Also, FAXes might be sent directly to the store and forward system from a sender's e-mail box, for delivery to a dialed FAX number.» «T.38 is the real-time FAX over IP protocol. This means it is designed to work like traditional FAXing. You call another FAX machine, and send the FAX as you wait. Either FAX machine could be a traditional FAX machine connected to the PSTN, an ATA box, or similar; it could be a FAX machine with an RJ-45 connector plugged straight into an IP network; it could be a computer pretending to be a FAX machine.» But that assumes you have the hardware. Maybe it could be possible to design a software only implementation :-? I don't know. I think not.

I think it must be about a decade since I last sent a fax.

I had to routinely send a fax a month for my mother medicines, till she died. After that I haven't tried, but I still have the hardware and software. However, now I have fibre telephone, some kind of VoIP, I don't know if it would work. My guess is "no". - -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlXDYbEACgkQja8UbcUWM1xMWQEAj1pQ3FiIW0zrU+kL0UUpnQWZ 2iP0MyJrf7MsRhyOn5oA/3bDqgIumbi+fZe0aEshNNo9xeHzofOnl4ff6AY33BIw =SvLL -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 8/6/2015 4:46 AM, Anton Aylward wrote:

On 08/05/2015 10:41 PM, greg.freemyer@gmail.com wrote:

...

On August 5, 2015 10:07:28 PM EDT, Anton Aylward wrote:

...

On 08/05/2015 09:57 PM, Billie Walsh wrote:

...

Print the form. Sign it with a pen. Scan it with Scan2PDF back into a PDF. Send it back to them. Problem solved.

We do it all the time with contracts for the TV station.

Like with the scanner built into the "all purpose" printer, which also has FAX capability ...?

You have a land line? I only have cell phones, so the fax is inop. :(

I have a VoIP service. I don't know if it will work with FAX. I haven't had a fax machine. ever. Once I loaded fax software on my laptop ... what about 20 years ago, and dill have a Bell line back then. I never got it to work right and had little use for it anyway.

I think it must be about a decade since I last sent a fax.

I too use VOIP/SIP, and sending and receiving Faxes has not been a problem. I use an OBI202 box ( http://www.obihai.com/docs/OBi202DS.pdf ) to a VOIP provider that supports fax (most of them do these days). It also supports googlevoice. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/06/2015 01:21 PM, John Andersen wrote:

How many pages actually have to be signed? One? usually. Not that big of a deal.

The issue isn't printing it. The issue isn't wasting paper. If I can download the form electronically from a web site in digital format; if I can cut and paste a signature image onto it; if I can generate/obtain an electronic certificate/proof of ID for electronically signing or certifying documents/email why can't I submit this electronically? Why do I have to use a technology nearly 175 years old, that pre-dates even Bell's telephone, never mind the Internet. http://www.todayifoundout.com/index.php/2014/11/shockingly-old-history-fax-m... Why do I have to use technology that has no means of proving who the sender is, the validity of the message, even though the import of the message may have far reaching consequences? Why do I have to do this when secure means with better identification and authentication mechanisms exist? -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Aug 6, 2015 at 11:34 AM, Anton Aylward wrote:

On 08/06/2015 01:21 PM, John Andersen wrote:

...

How many pages actually have to be signed? One? usually. Not that big of a deal.

The issue isn't printing it. The issue isn't wasting paper.

If I can download the form electronically from a web site in digital format;

if I can cut and paste a signature image onto it;

if I can generate/obtain an electronic certificate/proof of ID for electronically signing or certifying documents/email

why can't I submit this electronically?

Mix two parts: Because people are stupid and bad at their jobs. Mix one part: Because properly signed PDFs is a PITA. Anyone can create a self-signed certificate, and use that to esign a PDF. And it's a pain to do that. It's even more of a pain to acquire a legitimate 3rd party certificate, and use that to esign a PDF. But even if you do go to the effort of getting a 3rd party cert and sign your PDF, it's mainly because so many people are stupid and bad at their jobs that they don't know how to verify your esigned PDF, in order to accept it. Or they don't have a policy for how to accept it without verification, equivalent to merely accepting a signed fax without sending it to a handwriting expert. They don't have a policy and they're too lazy to create one. In defense however, digital signing is simply not easy, or an exact analog of, physically signing a document. Legally in most countries it now has the same weight which could work if there's authentication of the public-private key pair. But that's not easy or automatic or integrated. Those grocery store pads where you use a fake pen to sign your name on a touch sensitive screen? Complete b.s. Ask any handwriting expert and they'll explain it but basically there is no angular or pressure information conveyed in that signature which is integral in pen on paper handwriting analysis and signature authentication. Scans of, including faxes, can convey some of this information but obviously it's quite a bit noisier than the original, the idea originally was that there was in fact a hard copy original the facsimile is based on and in cases of important communication that original was filed. That's no longer true so really no one should be accepting PDFs with only visible signatures that aren't digitally signed, anymore than a PNG or TIFF of the same. And you as the creator of this document shouldn't send one that isn't editable, and is digital signed in such a way that at least it's provable that the document has been altered since it was signed. So if some company asks for a PDF with a handwritten signature, you should still digital sign it with at least your own self-signed cert, to encrypt it, prevent it from being edited, and thus able to prove whether it's been modified since signing. You can also disallow printing and copying of such a PDF (within the limits of software honoring this policy, obviously the fact it's being displayed at all means anyone could do an end run around the no printing policy).

Why do I have to use technology that has no means of proving who the sender is, the validity of the message, even though the import of the message may have far reaching consequences?

Why do I have to do this when secure means with better identification and authentication mechanisms exist?

People who don't know what they're doing. *shrug* -- Chris Murphy -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Aug 6, 2015 at 12:39 PM, Carlos E. R. wrote:

...

And you as the creator of this document shouldn't send one that isn't editable, and is digital signed in such a way that at least it's provable that the document has been altered since it was signed. So if some company asks for a PDF with a handwritten signature, you should still digital sign it with at least your own self-signed cert, to encrypt it, prevent it from being edited, and thus able to prove whether it's been modified since signing.

Ah. Didn't think of that.

How would you create such a signature in Linux? :-?

I've been too lazy to try to figure it out. I've used self-signed certificates generated in Acrobat to do this. The document is not encrypted, but it is hashed, the hash is signed, and the signed hash and public key go into the PDF. So at the other end they can confirm/deny if it's been tampered with since signing. It doesn't conclusively prove I signed it though, since it's self-signed. Of course, there's some chance it's intercepted. Modified. And then resigned with a faked self-signed key in my name. And sent from an account with a spoofed email address. So, it's like - next to b.s. I think the recipient would need a policy that requires DMARC/DKIM emails from source to accept such PDFs, and then archive the entire email original source. But really we need a better way to do this with verifiable keys rather than self-signed.

...

You can also disallow printing and copying of such a PDF (within the limits of software honoring this policy, obviously the fact it's being displayed at all means anyone could do an end run around the no printing policy).

Why? They may have need to print in order to file in paper. :-?

Just to hassle them for having asked for a digital document only to (try and) print it out at their end. You know, mind game. "Oh you were planning on printing a paper copy on your end? Huh, that's weird. OK fine I'll send another PDF you can print." And then at least I know I'm dealing with a crackpot, with email record of the clueless. The thing is, I've never been asked. So these PDFs just seem to vanish into the digital equivalent of paper filing cabinets where documents are buried. Until there's a lawsuit no one cares I think. But honestly if they're that antiquated they want to print a PDF on paper, why not just ask for a fax in the first place? (I haven't been asked for a fax in ~2 years in my business, and it's was probably 1-2 years before that for the time before. I always get a chuckle when it happens though. "Yes, here is the fig leaf...") -- Chris Murphy -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Aug 6, 2015 at 3:14 PM, Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

On 2015-08-06 22:16, Chris Murphy wrote:

...

On Thu, Aug 6, 2015 at 12:39 PM, Carlos E. R. <> wrote:

...

...

How would you create such a signature in Linux? :-?

I've been too lazy to try to figure it out.

I've used self-signed certificates generated in Acrobat to do this.

Well, yes, acrobat does it, but there is no more acrobat in Linux.

I have to look at LibreOffice options. It can encode, which I use. Dunno about sign.

Evince always comes up in such searches. And also just stumbled on this but only gave it a quick glance. https://paulbradley.org/digitally-sign-pdf-files/ I think this is definitely an area that needs to be better on all platforms. But PDF is sufficiently complicated that I think some of the work has been about narrowing the scope of what's included, and that's on-going work. Like, you can embed movies in PDF. But does it make sense to print a movie? No. So the PDF/X (various) formats all exclude movies, and exclude music files, and restrict features to more reliable ones that aren't brand new, and so on. The same applies to PDF/A for archiving. But for secure document exchange, is this well standardized? I don't know, and I think that's a pre-requisite I'd think any development effort outside of Adobe would want to see. Their able to get away with a pre-mature implementation when they have 90% of platforms covered with a mix of free and not free software, as that helps drive pay for software sales. -- Chris Murphy -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Am 06.08.2015 um 23:32 schrieb Chris Murphy:

On Thu, Aug 6, 2015 at 3:14 PM, Carlos E. R. wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

On 2015-08-06 22:16, Chris Murphy wrote:

...

On Thu, Aug 6, 2015 at 12:39 PM, Carlos E. R. <> wrote:

Evince always comes up in such searches. And also just stumbled on this but only gave it a quick glance.

https://paulbradley.org/digitally-sign-pdf-files/

and for Android there is: https://play.google.com/store/apps/details?id=com.xyzmo.signature.standalone -- Best Regards | Liebe Grüße | Cordialement | Cordiali Saluti | Atenciosamente | Saludos Cordiales Rainer Klier Research & Development SIGNificant Signature Solutions GmbH (a xyzmo company) Haider Straße 23 | 4052 Ansfelden | Austria Phone: +43 7229 88060 -707 Website: https://www.xyzmo.com/ Support: https://www.xyzmo.com/contact/support Get documents signed. Anywhere. At any time. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Friday, 2015-08-07 at 03:07 +0200, Carlos E. R. wrote:

On 2015-08-06 23:14, Carlos E. R. wrote:

...

I have to look at LibreOffice options. It can encode, which I use. Dunno about sign.

There is no option for crypto signing, but there is one to "sign with a watermark", with a box for "watermark text". What it does is place a background, large green text, as a watermark, in the PDF. Like those that say "DRAFT". So, useless for our purpose.

After updating to LO "4.4.5", I noticed that I can sign LO documents. I need to tell LO where is the Thunderbird or Firefox or Mozilla certificates, then it imports them. The generated PDF is not signed, though. Only the LO document. Save again, and the signature is removed. I'm also unable to sign PDFs with the Linux version of acroread: I click on sign, nothing happens. - -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlXQ8NEACgkQtTMYHG2NR9XinwCgg00HLD6V7iOA3P0OgCttHclf MP8An3eXDt3GfnEJfLkpDbbzIxE0mLQL =CdoR -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Aug 6, 2015 at 12:12 PM, Chris Murphy wrote:

And you as the creator of this document shouldn't send one that isn't editable,

Umm, what? Could you clarify? Why yes, what I meant to say, "should not send a PDF that is editable". -- Chris Murphy -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Aug 6, 2015 at 2:19 PM, Anton Aylward wrote:

On 08/06/2015 03:58 PM, Chris Murphy wrote:

...

On Thu, Aug 6, 2015 at 12:12 PM, Chris Murphy wrote:

...

And you as the creator of this document shouldn't send one that isn't editable,

Umm, what? Could you clarify?

Why yes, what I meant to say, "should not send a PDF that is editable".

Well isn't that the wonderful thing about FAXes. A bit of white tape or White-Ex ....

Yeah but you can produce an original that can be verified and even fairly well dated if it got to this level of legal questioning. Whereas with a PDF, just letting it get edited digitally, there is no such aging so you really kinda do need to digital sign PDFs of any consequence even if the person at the other end says they don't accept such things. Slap on your PNG/TIFF signature. But still digital sign the PDF. -- Chris Murphy -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Aug 6, 2015 at 3:25 PM, James Knott wrote:

On 08/06/2015 04:19 PM, Anton Aylward wrote:

...

Well isn't that the wonderful thing about FAXes. A bit of white tape or White-Ex ....

I suspect that's about the limit of tech abilities of the typical lawyer. They simply don't understand how easy it is to tamper with a document or spoof a FAX number.

Right which is why notary public, ink and paper, are still primary in anything serious. About the only thing valid with a FAX is, who would want to bother with one unless they absolutely had to for some otherwise trivial task? It's a self-selecting device is why it remains mostly trustworthy. -- Chris Murphy -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/07/2015 03:29 AM, Rainer Klier wrote:

Am 06.08.2015 um 20:12 schrieb Chris Murphy:

...

On Thu, Aug 6, 2015 at 11:34 AM, Anton Aylward wrote:

...

On 08/06/2015 01:21 PM, John Andersen wrote:

...

Those grocery store pads where you use a fake pen to sign your name on a touch sensitive screen? Complete b.s. Ask any handwriting expert and they'll explain it but basically there is no angular or pressure information conveyed in that signature which is integral in pen on

not all of them. for example the wacom stu-520 or wacom stu-530 devices do have pressure and time support.

And the corner grocery stores and the small stores that double as postal outlets or have a wall of mailboxes for hire can afford a high end unit like that? I've yet to encounter on on my travels. Heck, my phablet in drawing mode has more sensitivity. Yes I recall at a IT Trade Show a Waterloo based company was touting a software package for the iPad that had all the sensitivity, recorded it and wrapped it in a certificate. I'm sure banks and brown vans and postal outlets would love it. The next year they were there at the show without this product. Perhaps that says something about the demand. As we all know, technological superiority does not mean market superiority. -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/07/2015 07:23 AM, James Knott wrote:

On 08/07/2015 07:17 AM, Anton Aylward wrote:

...

As we all know, technological superiority does not mean market superiority.

For example, OS/2 vs Windows. I have yet to see a desktop that can do many of the things OS/2 was doing 20 years ago.

At just about any point in time Windows could be compared to other products in the marketplace and an found to be technically inferior. It may require looking at a particular aspect; some like malware susceptibility seems baked in to the Windows architecture! You might point to others such as the risks involved in having to run at Ring0 to achieve acceptable performance. -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/05/2015 09:39 PM, Anton Aylward wrote:

or the person in question seems to have agreed to something like "voluntary commencement" to psychiatric rehabilitation.

So, when do you get out? ;-) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/05/2015 09:28 PM, Carlos E. R. wrote:

Years ago I sent faxes "signed" by pasting a scanned picture of the signature into a Word document. It was fully accepted by recipient, which of course, knew not how it had been "signed".

Years ago, I did the same, though with Describe. I wrote my signature several times on a sheet of paper, which I then faxed to my home computer. I would then paste one of those signatures into my document to "sign" it. http://www.amazon.ca/Describe-Processor-Version-Users-Guide/dp/1565298853 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2015-08-06 04:19, Chris Murphy wrote:

I have not tested this, but I'll bet dollars to donuts that you can do this with Scribus. Create a new document, place the PDF page X in the default frame, create a new frame and in that add your signature file, drag the signature frame over to where it belongs. Export PDF. And now use a free PDF2FAX service.

There are many ways to do it. Let me see... the original is a PDF. Let's assume it is a PDF form which is filled in the computer. Then print it to file. - Open the file in gimp. - Open another file that contains the scanned photo of your signature (make sure the background is the same; if not, paint it). - Superpose both. - Print the result to PDF or paper. FAX it out. If you do not have a fax-modem machine, or if the land line will not admit sending faxes, go to a corner shop that sends faxes. Here (Spain) the post office will do it, with the advantage that it is official in court (there is an ancient local curse about courts and winning). There are also services that you email them a document and they fax it for you. Some ISPs do it. My old cell-phone company did it, a decade ago or so! I think I sent an SMS, and they faxed it. I tried once. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2015-08-06 13:25, James Knott wrote:

On 08/06/2015 07:25 AM, Per Jessen wrote:

...

ghostscript will do something like that. I'm pretty certain I've done that before.

In Open Office, I used the PDF as a watermark and then could enter text over it.

Or another photo. - -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlXDZnIACgkQja8UbcUWM1wPFgEAk7OnVSo/uYerJqrnB1mLxsdj eBgi8uJ5mT3XnZhBP/IA/26Yf/Tj+c9t7q1jvum1CjRkbszf0kPAIJItCG2kaWzW =s1Xf -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 08/06/2015 08:41 AM, David C. Rankin wrote:

Anton,

For the past decade or so, the easiest solution for this electronic quandary for me was simply to sit down, write your signature a couple of times on a plain sheet of paper (with a fat tipped pen), then scan and choose the one you like. Pull it into gimp and make the background transparent and scale it to a reasonable size.

Indeed. When I got my phablet I used a app on that to do the same thing. No need for paper, no need for scanner.

...

While on the subject ... I seems ridiculous that the agency will accept a FAXed document, faxed from a corner store. They don't have my registered signature on file. Since I went VoIP my phone # isn't in the published phone book and cell phones don't seem to appear anywhere.

It looks to me as if this is piss poor security; anyone could download the PDF form from the web, fill it in, use any signature that looked like an scrawl beginning with an A-she and ending with a D-shape and any phone number then fax it back, all leaving me completely ignorant.

Yes, yes and yes. You might want to check on the various agencies you deal with, the revenue/tax people, the people who issue your professional certifications. You might look into what "proof of identity" it takes to open a bank account or get a driving licence. Recently I attended a presentation by a person who worked for a law firm, and as such was supported in dealing with an identity theft case. Someone got a photocopy of her driving licence and over-typed, on a different font, a new name. Used that as ID to get a set of mortgages and land transfer and stole her house from under her. This too involved faxing poor resolution, poor quality documents back and forth, apparently from the 'corner store', with no authentication. The banks accepted it it, the various civic institutions and land registration agencies accepted it, the utility companies accepted it, the phone company accepted it, the locksmith accepted it. The new utility bills were then used as proof of residence in obtaining a new driving licence... Eventually and at considerable cost it was all worked out, but took 2 years and a lot of anguish. She obtained copies of all the documents that had been 'forged'. Quite honestly they looked such poor quality they would not have fooled me. She polled the audience and of the 60 or so present only a couple said they might have accepted it. Really, though, once you start drilling down you find that despite the aggression you might encounter, for example with border guards and law enforcement officers in 'stop with cause' situations identity verification is weak in our bureaucracies. You only have to read of the way con men (Kevin Mitnick is one example in the computer world) how talk their way into things simply by asserting they are someone with authority. Think about what it takes, for example, to get a passport. A friend did that recently. She took along her birth certificate. I must admit that is lousy ID, its not as if it has fingerprints (though some places 'foot-print' babies) or picture ID. In fact they asked her for her driving licence since that had photo-ID. Think how easy it is to get a driving licence is any name you want... Our security agencies and government agencies really don't have meaningful security against intelligent, determined criminals or terrorists if this is how they manage IDs and records.

This seems arcane, but there are specific legal reasons for it. The reasons are generally rooted in the statutes of civil/criminal procedure under the section for "Signing of Documents". There is usually a long list of what signing signifies (facts are within personal knowledge and true and correct, not filed for improper purpose, etc, ...) and it also provides penalties for violation of the rule (being held in sanctions, contempt, disbarment, etc..) So while yes, anyone could put a big "A..." and you would be left in the dark, there are laws on the books to handle that case (not so yet with most if not all of the certificate equivalents)

Most of those laws involve witnesses and a affidavit signed and attested to in the presence of a notary or lawyer and certified as such under their seal. Even signing the tax forms in front of my accountant is "good enough" with him as a witness. But downloading forms from any number of governmental, non governmental, banking or a host of other commercial entities (such as, for example, I had to do when telling one provider I was giving up and transferring my number to another) did not involve such measures. Just scribble a signature and fax them off. I don't need the skills of the players in the old TV "Mission Impossible" to photo a signature (even if it is my own) and make a digital image, paste it in to the form using the methods in this thread, then either email it as an attachment (since that does not require a digital signature on the document or email) or fax it from some anonymous corner store. No wonder ID Theft is one of the fastest growing industries. Its so easy! -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 8/6/2015 6:18 AM, Anton Aylward wrote:

No wonder ID Theft is one of the fastest growing industries. Its so easy!

As the CEO of LifeLock found out. https://kenhoma.wordpress.com/2013/08/02/hacked-lifelock-ceo-spanked-by-iden... -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org