Wet Signatures In PDFs are Just Silly!

Wet Signatures In PDFs are Just Silly!

As a company, Apple makes great products and generally has a good track record in security. But, when they promote the signing of PDFs with a wet signature, they are perhaps not taking the building on a more trusted world seriously [here]:

No one should trust these signatures, but still, we are asked by legal representatives to produce PDFs which have a wet signature or to take photographs of documents, or even send in utility bills to prove our address. It is a false world of trust:

For Apple, I really would love to see them creating proper digitally signed PDFs, and for us to start to create signatures which had some credibility, rather than pushing an old world of wet signatures.

The chance of someone forging a signature on a PDF is 100% (as they can capture their image from other documents). And the chance that someone can digitally sign a document with your 256-bit private key is:

1-in-170,141,183,460,469,231,731,687,303,715,884,105,728

But, still, we blindly sign our Word documents and send them as proof of our signatures. And then even convert them to PDFs, and which make them look a bit more secure. But, the conversion between PDFs and Word documents, is trivial, and they are almost interchangeable these days. I remember having a debate with a fellow academic, who said that they used PDF documents for their slides so that the students couldn’t copy them, but then showed all the different ways that the great encapsulator (Acrobat) could convert to most formats:

Generally, the legal profession and many corporate environments, need to catch up with technology and understand the need for legally accepted digital signatures, such as those used in eIDAS2 in the EU. Apple pushing a method to add a signature to a document is in no way advancing our world of digital trust.

Signed: Bob Dylan