Schneier on Security
A blog covering security and security technology.
« Nikon Image Authentication System Cracked |
| Unintended Security Consequences of the New Pyrex Recipe »
May 3, 2011
Decline in Cursive Writing Leads to Increase in Forgery Risk?
According to this article, students are no longer learning how to write in cursive. And, if they are learning it, they're forgetting how. Certainly the ubiquity of keyboards is leading to a decrease in writing by hand. Relevant to this blog, the article claims that this is making signatures easier to forge.
While printing might be legible, the less complex the handwriting, the easier it is to forge, said Heidi H. Harralson, a graphologist in Tucson. Even though handwriting can change -- and become sloppier -- as a person ages, people who are not learning or practicing it are at a disadvantage, Ms. Harralson said.
"I'm seeing an increase in inconstancy in the handwriting and poor form level -- sloppy, semi-legible script that’s inconsistent," she said.
Most everyone has a cursive signature, but even those are getting harder to identify, Ms. Harralson said.
"Even people that didn't learn cursive, they usually have some type of cursive form signature, but it's not written very well," she said. "It tends to be more abstract, illegible and simplistic. If they’re writing with block letters it’s easier to forge."
Maybe, but I'm skeptical. Everyone has a scrawl of some sort; mine has been completely illegible for years. But I don't see document forgery as a big risk; far bigger is the automatic authentication systems that don't have anything to do with traditional forgery.
Posted on May 3, 2011 at 2:25 PM
• 55 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I've never understood why "signatures" were ever considered to be a security measure in the first place. All it takes is a little while to study and practice to fake pretty much anybody's signature well enough to fool people with it.
I have for some time been of the opinion that signatures are best thought of as an audit mechanism - not an authorization mechanism. Especially in today's world you can forge signatures 'well enough' very easily. They won't hold up to good analysis downstream, but if you're the criminal, you've already got your loot by then, so who cares?
I think the electronic signature devices are worse. About 90% of the time that I have to sign for my card, it isn't on paper. Most of those devices are so bad that I can barely even make it out after I try to sign with one..
If you read the original article, its clear that "easier to forge" really means "harder to authenticate". Maybe what's needed is either a better system of authentication, or a better system of attesting (signing).
Funny, I've actually fallen into this trap. The only cursive I've written over the past 10 years has been my signature. I have 18 characters in my full name. My signature has evolved into a leading "K" that only slightly resembles a "K" followed by a very erratic scrawl that involves 4 or 5 random ups and downs. I finish off with an "i" dot and a "t" cross (though there are in fact 3 i's and 2 t's in the 18-character name).
Humorously, in the context where a signature is important, such as signing the Deed to a house, I feel it is important to have a legible signature. So I slowly and tediously, feeling like I'm in 1st grade all over again, spell out my name in cursive.
The two worlds collided not long ago when an insurance company spent 30 minutes and 3 fax exchanges trying to determine why "clearly" two different people had signed documents pertaining to my insurance account. They only caved when I sent them, on the same paper, my "fast" and "slow" signatures side-by-side. I think the handwriting expert on the other end sprouted a few grey hairs, politely thanked me, and spent the rest of the day wishing for retirement.
Regardless, I'm thinking that a fingerprint or other biometric would be a far better solution to contexts in which a signature is needed for authentication; and no signature at all should be used where it is not needed.
To Kevin's point, I guess I would know if someone attempted to sign as me without having seen my signature before (because let's face it they are easy to forge). If my signature does not look like a sloppy mess with only 2 legible characters I know it was not me who signed it (I dont follow the slow and fast practice)
I think this has more to do with poorly implemented signature systems then with the decline in handwritten documents....
Why would someone take time the time to carefully sign 30 signature boxs on a contract? Why would they even bother trying to make their signature legible on those horrible lcd signature systems you see at nearly every point of sale?
And when was the last time most people have been challenged on a poor signature?
If the collection system is tedious and nobody reviews the outcome; why would a user bother with a careful signature at all?
Like baseball players, I believe it is in your best interests to have different signatures.
1 for important stuff like banks, 1 for credit cards, one for very important stuff like house titles, one for employment docs and NDAs.
The more risk to you personally, the less people who should have access to your signature.
My writing style is a bastardized mix of cursive and printing. Teachers kept telling me my writing wasn't good - so I stopped cursive writing and began printing cursive letters. The only more or less fully cursive writing I do is my signature.
As a result, my handwriting is usually pretty legible.
I suspect the reason most people aren't doing cursive writing is the same: they kept getting dinged for it, so they stopped and either got sloppy or went to printing depending on whether they cared if anything they wrote was legible or not.
Good points. The whole thing seems pointless. Michael categorized them as an audit mechanism rather than an authorization mechanism. If the signature is consistent and proper, this is the case. Bruce's post suggests otherwise. In my opinion, signatures are a useless defense against the attacks that would cause the most damage. We need to get rid of that obsolete scheme or mandate that the public maintain skills that make it useful, especially considering signatures themselves are often mandatory.
Speaking of declines, it's a sad day when the NYT doesn't know the difference between a "graphologist" and a "document examiner".
Given that most credit card transactions I do under $50 don't ask for a signature, and most transactions I do over $50 are online, I rather think that signatures have become obsolete. Never mind that for years I've kept mine in my PDF editor so I can paste it into forms.
I remember reading some time ago over on zug.com, a guy who got curious as to just how bad his signature would have to be for it to be rejected:
This was pretty much the point when I stopped caring how legible my signature was; it's pretty much now a "B" and a few wiggles.
Many clerks will dutifully hold up the back of the card and compare, but I've never been challenged. Empirically it's useless as an authorization step... and if it's only a post-transaction audit mechanism, why make the clerks check it at the time?
Now, if we had a way to automate an attack against thousands of handwritten signatures at once, we'd have something! Of course, the offsetting factor here is that a password (for example) must be exact, whereas a signature can be "meh. Sure."
@Brent "and if it's only a post-transaction audit mechanism, why make the clerks check it at the time?"
Ideally, the clerks should look at the signature and at the person signing (to associate them together in memory), but in reality there are too many transactions in the day. A better form of auditing would be a digital picture taken at the time of transaction and printed on the receipts
It reminds me of an older lady with whom my wife is friends. She refuses to use her credit card, favoring the PIN/debit method, except where absolutely necessary because she just knows that signing for things is how she'll have her identity stolen. *facepalm*
Excuse my snickering at this. Seriously, they are worried about signature forgery? The technology of hand signing was based in a time when the majority of the world was utterly illiterate. We need to move past hand signing entirely and into a new realm. Chip and pin credit cards are a good start. Why thrash around in archaic technology when we have better methods anyways. No matter how complex the signature is, everything you need to forge it is conveniently what you need to authenticate it. If someone gets even 1 copy of an authentic signature, they can reproduce it infinitely. It's about as safe as writing your favorite 50 digits out and declaring that uniquely identifies you.
I thought signatures were seen as more of an attestation than authentication. Thus signing something is taking responsibility for the contents (accepting liability for perjury if you lie on gov. forms or for civil suit in the case of a contract) more than it is verifying your personal identity.
I sign everything with a poorly drawn picture of a dog. I've only once ever been stopped for this, by a grocery clerk.
As a fun experiment:
When ever you are asked to sign some payment by hand try to do a different signature or at least a different from the signature on the electronic cash/creditcard.
My experience so far: About once in a hundred times it is noticed that the signature is not the same as on the card.
This noticing leads to maybe a question ... but doesn't mean I am asked for some ID or anything else. And the card/payment gets accepted anyway.
@Kevin: Fingerprints are passive -- they can be obtained in numerous ways without your consent (even without your knowledge).
Handwritten signatures require active action -- making them a bit more useful for authentication.
Still I'm wondering, how much of my genuine signatures would be rejected by examiners, if they where actually tested.
For things like deliveries and in-person purchases I don't know why companies don't make greater use of photographs.
Electronic cameras are ubiquitous and memory storage is cheap, and a VGA quality photo is plenty good enough for a basic mug-shot ID.
I once witnessed a friend buying on behalf of another friend using the other's card and absent-mindedly signing with his own name.
When the salesperson inquired about different names, he mumbled something about having taken his wife's surname at marriage but not yet updated his account. The salesperson accepted that without a second thought!
Hereabouts (central Europe), signatures have never been intended to be *readable*, they should just be *unique* and *reproducable* only by the signee.
Mr Doyle: So, you never learned cursive?
Bart: Well, I know hell, damn, bit...
Mr Doyle: Cursive handwriting, script. Do you know the multiplication tables? Long division?
Bart: I know of them.
"signatures have never been intended to be *readable*, they should just be *unique* and *reproducable* only by the signee"
Good point. I know over time the quality and legibility of my cursive writing has deteriorated because in this digital age I don't practice it as much as I used to. Same thing for my tennis game, for that matter. My dad however, who was a calligraphy expert, taught me how to do complex signatures any non-professional would have a really hard time to forge in under five minutes when challenged to reproduce it on-site , by hand and then have it compared to a known original one. Which in my opinion is really the only purpose it is useful for. And with which I certainly don't mean on these ridiculous LCD systems. That really is like eating soup with a fork.
Regardless of the discussion of whether or not signatures still have a place as a valid authentication, auditing or other mechanism, the matter of the fact is that this practice is still widely in use in many places. Which means that failure to produce a reasonably complex and consistent signature may put you at a slightly more elevated risk of getting defrauded or questioned as compared to someone who can.
If you're not producing the signature on-site, it ought to be little more than a simple matter of coding to get a robot to sign your signature absolutely perfectly.
For that matter, anybody here old enough to remember "signature" stamps? (As in ink pads and stamps...)
Now I feel old...
> I have for some time been of the opinion
> that signatures are best thought of as an
> audit mechanism - not an authorization
> The only cursive I've written over the
> past 10 years has been my signature.
Yeah, that too. I had to write in cursive once or twice in college, but *only* once or twice. (It's a rare exam where you can't just print, and homework was always printed.) I haven't done it on anything resembling a regular basis since the middle of my junior year of high school when I got my first computer, January 1992. At this point I can't even comfortably read cursive anymore. I can decipher it given enough time, but it's harder than reading Greek or hiragana.
As for my signature, it is thoroughly illegible, and it would probably only take about five minutes for a random person off the street to learn to forge it well enough to fool someone _else_, but it would take MUCH longer to learn to fake it well enough to fool me, to say nothing of a professional handwriting analyst.
The individual letters are irrelevant: it's been so long since I wrote anything in cursive, I have come to view my signature essentially as one big fat glyph (well, two, really: I still make the given name and surname separately, for purely historical reasons that have nothing to do with the letters they no longer resemble). I don't even remember how to make all of the individual letters in my name. So what? I definitely still know what my signature looks like. I write *that* thirty times a week, so I'm not going to forget it *any* time soon.
Don't forget too, a signature is legally valid even if it's just a line. (There are legal reasons for this, having to do with anti-discrimination law and historical differences in literacy rates and access to education in different demographic segments -- reasons that aren't necessarily so important in today's world, but laws don't magically vanish off the books just because they're no longer really needed.)
In the Orient, everyone had (has?) a personal chop, with which you STAMP official documents. My father had one for when he was doing business there in the 1970's. Signatures are not a universal means of authentication.
Like many others here, I don't use my hand-written signature often. I prefer not to touch those styli attached to most POS e-signature pads, so I usually just draw a few random lines with the edge of my credit card. No one has ever called me out for doing this, and only once has the machine rejected my "signature."
I am neurologically incapable of writing my signature the same way twice. Every piece of paper I sign is a unique artwork that can't be reproduced. Sometimes I get reasonably close, near enough that I think it could be considered to be a reasonable attempt at a forgery. Usually it's not that close. But I have never had anyone challenge my signature.
The best signature I've seen is from an Asian friend who signs in Chinese. In a country where the vast majority of the population only know English his signature works really well as writing clear Chinese characters is really difficult if you didn't learn them when young - maybe his signature is equivalent to block capitals in south-east Asia.
I'd like to get a Hanko next time I visit Japan. Not that I could use it for anything serious.
Maybe I should just follow Zug's example and draw stick figures or something.
Most states in India use more than the signature for really important stuff like registration of real estate transactions etc.
This consists of the signing parties and the witnesses:
a. Signing the document on all pages (except witness on last page only)
b. Getting their photo taken by webcam and thumbprint scanned
c. Signing a printout summary of the transaction that includes their photos and thumbprints. This is then attached to the document itself
Not foolproof of course (eg no proof is needed to state that Mr A is indeed Mr A and is a legitimate seller) but does reduce the possibilility of, say, wills being contested...
The Zug prank was hilarious and thorough. The last one was, if I recall, a drawing of the digestive system and rectum on Walmarts signature pad. The woman behind the guy noticed and showed discussed, but the clerk never flinched or complained. Even when he stopped to take pictures of it like he always did. That alone would have gotten my attention...
Is this an American thing? I learned to write in the UK 40 years ago and we never did cursive - we learned something we just called "script". But a signature is a whatever you choose and mine isn't even intended to be representational of my full name.
Now we have digital signatures, which are a gazillion times more useful than cursive anyway.
I study calligraphy but I don't pretend it's practical, it's an art.
"I sign everything with a poorly drawn picture of a dog. I've only once ever been stopped for this, by a grocery clerk."
Also, this ^
@RB & Dirk re: not requiring readable signatures
Don't know what part of Central Europe your talking about but here in Poland there are several legal situations when you are actually required to produce a legible full-name handwritten signature. Otherwise, any scribble will do.
This might be out of date in these days of 100% literacy (yes, that is sarcasm) but it's not actually your "signature", it's your "mark". This is why serious contracts require witnesses.
As the Shadowrun and Cyberpunk RPGs say, in this "age of surveillance", it's important not to leave a consistent trail.
So the worse your handwriting is, the better for leaving unintelligible signatures - such as your "John Smith" or "A. N. Amos" when you sign in to the motel with the woman who is not your wife.
OTOH, it's supposedly hard to really disguise your writing from a professional forensic handwriting analyst. Although I've never been sure whether that was any more legit than the polygraph scientifically.
So it's probably best to avoid leaving your signature anywhere and at least try to fake it when that isn't possible. You might do it well enough to introduce "reasonable doubt".
I had an interesting situation earlier this year. I needed to sign a medical/insurance form after having surgery... on my right shoulder. I still had a nerve block on my right arm, so had to sign with my left hand.
Needless to say, it was about as accurate as if I had been a stroke patient. Of course, if the signature doesn't NEED to be accurate for this document, then we go straight back to the point raised early on... why ask for a signature at all?
A) a signature of "YOURNAME" at the bottom of a telegram in 12pt Pica is valid and binding in a legal sense does it matter?
B) no one checks. My mom signed my dad's payroll checks for deposit for decades and wrote out all the bill checks.
Never questioned on it. Nor did those checks my dad wrote ever get questioned.
I don't even really bother to "sign" anything any more unless its an "important" document (i.e., drivers license, passport, mortgage forms, etc). It's more of a scrawl. My handwriting was never good, and since I literally type everything these days with very little exception, my handwriting has deteriorated to the point where I can barely read it myself sometimes.
Question: How often do any of you actually have to sign anything today? My most frequent signature is on the receipt at a restaurant where I pay with my debit card. Other than that, I've gone electronic.
The back of my credit card is blank. My signature on receipts is usually a scribble whose resemblance to my actual name is purely coincidental.
No one has ever notice. Sometimes they ask me to show ID, at which point I joke that, apparently, I must be 21 to buy lettuce or an external hard drive or what have you.
Signature capture devices at POS are interesting. I've been running an informal experiment for a while to map the boundaries of what they will tolerate. Some are happy with a single pixel. Others demand at least one line segment; geometrical figures with one, two or three horizontal or vertical lines or a combination are accepted. (It's always a thrill when the display flashes APPROVED!)
One day I encountered something new: a signature capture device that repeatedly rejected my signature---my real signature---until the clerk informed me that it was looking for a certain minimum level of complexity in the scrawl. Sure enough, at least one closed loop seemed to be required before this clockwork art critic would accept it. I wasn't even colouring outside the lines.
The device appeared to be a Verifone MX870.
related note: i use credit cards almost exclusively, and recently they've been having me type in my zip code (five-digit postal code in USA) to "authenticate".
I've experimented and find that a single digit, not even the first digit of my actual zip code, suffices. So is it any surprise that signatures are optional?
All these cursive writing oldies keep complaining about how nobody knows how to do it anymore. But what about languages that do not have any congruent to a cursive script?
More importantly, I've noticed that at least in the state of TX that more and more retailers are demanding ID yet are not even bothering to look at the signature line. This continuously irritates me because I refuse to show my ID to make a $20 purchase. We all know it does nothing to stem the flow of credit fraud. Last time it occurred, I was asked to prove that I'm an employee of the business named on my card - even before they ran the card. The whole system has an issue over the authentication versus auditing, and every applies the wrong solutions to the problems.
According to the CBC, "Banks don't look at names, signatures on cheques"
As a visitor to the US I have had similar and catastrophically unsimilar experiences. When purchasing petrol for my hire car at the Grand Canyon, it accepted my 4 digit Australian post code... very lucky, because it was a Sunday and the station seemed to be unattended.
Later at Vegas, the pump would not accept a 4-digit post code, so I had to pre-pay inside, then return after filling the car to get my change... unfortunately queueing for 10 or so minutes on each side.
If verifying post code attached to the card is even feasible, it would be nice to acknowledge the rest of the world. Not even any alpha characters for visitors from the UK, where my 7-digit post code started SE19.
If security is a struggle with usability, this seems to be a losing case with neither.
A simple statistical question; how common is visually identical handwriting?
I ask because I met someone at university who had identical handwriting; we were both on a students' union committee, and we determined experimentally that we could take dictation from each other, sign the resulting handwritten documents, and then later be unable to determine which documents were genuinely written by the puported signatory, and which were dictated to the other person.
Now, we had an advantage in that we were taking dictation in roles where the form of words was relatively, not forging documents afresh, but we could still have chosen to "cheat" the students' union by signing off on each other's work, and be unable to demonstrate that the signatures were forged (because there were no differences - we even used the same stroke paths to sign things).
Is there any data out there to show that this is not a significant threat? Conversely, does that data not exist at all - have we been assuming that signatures are always hard to forge, even though I, at least, have a counterexample?
It seems most people just scribble their name for a signature. I was only taught cursive for a couple of months in elementary school, and never really had to use it again...except when I sign my name.
I think today's educational system tends to focus on using modern technology so much, that they have really lost their grip on teaching students the simple things - such as cursive.
There is already an app for smartphones which will read cursive and translate it into text. How long I wonder before reading cursive and then reading at all becomes a forgotten art except for a few hobyists?
Can't say much about the kids of today and how they write (and what style of cursive they learn). But I write it a lot, because I never liked the pure block letters.
But I have to admit that I write some block letters, when they are at the beginning of a word. But not always, I switch from cursive to block wthout any kind of 'policy'. That could become a problem with the first letter of my first name.
I never had any problems with different first letters in my signature, so far. And I'm surprised about that.
the question about signature forging is how you inspect the signature.
A human expert? A computer algorithm (and what kind of algorithm)?
and which attributes will be analysed?
Just the picture of the signatue or the writing / signing process?
You should see how hard it is to sign my and my husbands names on tax checks etc. to make them look different. It is impossible for me to make the S @ beginning of last name and the r @ end look different.........................!
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..