No Stupid Questions

The visual signature part of a "digital signature" is purely cosmetic. The actual signature is the entire file being cryptographically signed using a private key you possess, which any recipient can then verify came from you by using a public key.

This is the case for all government issue signatures (like when using the private key inside a chipped government id card) or any other signature created using a key pair from a issuing authority.

If its not a digital signature in this way, the other way is literally just an image. It can be a vector or an raster, or a straight up scan of a physically signed document. It's just a picture. It has no digital verification whatsoever.

physical signatures are just asking you to write your name in a box....

Not a huge difference.

Digital signatures are much more than "just typing your name in a box". The few times I digitally signed a doc I didn't even have to do that, just click on a big green button.

It's all connected to how you authenticated before you got to that point.

I think @mentaledge@sopuli.xyz explained it well.

The point of the signature isn't the mark, but that the affirmation on the document can reasonably be tied to you. For most of history, it has been tied to a certain mark, whether it be a signed name, a stamp or embossed seal, or even a drawing. That system generally breaks down in the digital age.

A low hanging fruit that is seen to work is having the mark of approval get tied to an account under the control of the signee. It isn't so much that you made the mark but that it is tied to an email address you control. So even if you don't sign it with an actual signature, it still gets tied to you.

I was at a grocery store back when you had to sign the little digital screen for a card transaction and I finished signing, but the cashier got distracted and didn’t accept the signature for a while, so I just doodled Godzilla trashing a skyscraper next to my name.

My best friend was there with me and from that day forward, I’m not sure if he’s ever signed something without adding a Batman logo.

Signatures are arbitrary.

Had my identity stolen. Thief bought a car with a loan they got online. Forged my signature at the dealer half a country away. I hired a lawyer because BofA are fucking criminals.

Me: "This is clearly not my signature on this document. Doesn't that mean anything?"

Lawyer: "Nope. Not a thing."

WTF.

Now anything asking for my signature is squiggles unrelated to the written language.

It does as much as does "testifying under oath" does to magically stop you from lying.

i.e., putting your hand on a significant bit of text and saying some special words doesn't stop you from lying, but it DOES create / enhance penalties if you do.

Signature matching/analysis isn't particularly scientific, so in general a physical signature is used for clear authorization, not identification. When you log in to something to sign your identity is already set by other means, so all the signature needs to do is say "yes, I agree to this". E signatures in the US were legally formalized awhile ago, so it's not really a controversy.

I think a digital signature is also a way they can prosecute for impersonating someone for identity theft. By you typing and saying "this is me" if it's not, they can use that as evidence.

I scanned the responses, and didn't see anyone who mentioned this.

The point at which the U.S. allowed you to "sign" your name by typing was when the E-Sign Act was passed. That was in 2000, long before LLMs were really a concern.

The reason was to make online commerce easier. Verbal contacts could and continue to be enforced, but enforcement requires more effort than with a written contact.

At the time I thought the law was passed by people who didn't understand technology and how easy this made it for people to commit fraud or screw over consumers. However now I realize they just didn't give a fuck.

The truth is, wet signatures have been absolutely worthless for .. well forever. The first time I had a credit card was in the late 80s and even back then it didn’t make any sense that I was signing receipts in the grocery store.

IMO, that's not a digital signature. That's a normal signature on a computer. Digital signatures involve cryptography. For example, OpenPGP.

The actual shape of your signature hasn't really meant much for some time. As recently as 2005, Visa's contract had the most bizarre requirements.

You are supposed to sign the back of your card. If you paid with the card, you had to sign the receipt. The cashier was supposed to examine the signature on the card and the signature on the receipt and decide if they matched.

But. If the card was not signed, the cashier was supposed to insist that the person present sign the card, and then the cashier was supposed to compare the signatures right there. We were also forbidden by contract from asking for ID.

Where have "they" stopped allowing written signatures?

Your signature can be whatever you want to sign. I sign different things all the time. The legality is just in you consenting and making your mark.

Your signature looks different every time you sign it, and it being an exact replica was a way to spot a forgery. A signature has never been some sort of security feature.

I think that's probably it, or pure cargo cult because "we've always had signatures so something's got to go in that slot". The whole idea of random scrawls for "authentication" has been weird all along. As if everyone walked around knowing what everyone's signatures should look like. And if you do know, you can just... write it that way.

(Plenty of countries just have digital "signing" that's a bit more like something sane, a central authentication thing based on your ID number and 2FA.)

We do digital signatures slightly better here