8

We have a flow where the user signs a contract drawing their signature with the finger. But it's very important that that finger signature is similar to the user's real signature printed in the official ID card.

How would you do to try to guarantee that?

Improve this question
11
  • 3
    Also, does the comparison need to be computer-programmed/automated, or can it be affirmed manually by another party standing there? (Or course, this would amount to notarization, and raise the question of why you're not just actually employing a notary public to validate identity.)
    – David
    May 14, 2020 at 17:24
  • 7
    You need to look into the legal requirements around signatures. I do not think they are what you think. It's the act of signing that says you approve not what you see on the paper is my understanding for the US.
    – historystamp
    May 15, 2020 at 6:11
  • 7
    Perhaps this is very dependent on legal jurisdiction. In the UK there is no requirement that your signature looks the same every time, there is no "official legal signature". What matters is whether you did, in fact, sign it. Using the same signature provides evidence that it was the same person, but it is not conclusive evidence, as signatures can be forged. Conversely, using a different signature does not mean that the contract is invalid.
    – Ben
    May 15, 2020 at 8:57
  • 3
    The protection provided by a signature is that signing someone else's name is a serious criminal offence of "creating a false instrument" which carries a maximum ten year prison sentence. Dishonestly denying that the signature is yours is fraud, also ten year maximum.
    – Ben
    May 15, 2020 at 9:03
  • 4
    This looks a lot like an "XY question".
    – Federico Poloni
    May 15, 2020 at 19:15

5 Answers 5

Reset to default
46

I don't think you can guarantee it

If you try to make people mimic how their signature 'should' be, you'll open a lot of cases where people struggle with their device and can't get it to look the same. It reminds me of every time I receive a parcel, and they make me sign that I received it. Even with a pen my signature ends up looking like a 3-year old tried to counterfeit my signature.

Generally you will use other ways of verifying if someone is who they claim to be, other than signature. Is it truly a requirement that the signatures match? It can be mighty difficult to implement that, since people can have their signature change over time AND a finger drawing on a screen isn't exactly the most accurate.

When it comes to digital signing, there's usually a few steps that precede the process.

  • Login to a safe environment using login credentials, with or without 2-factor authentication.
  • Identify using an ID-card, passport or driving license

The signing itself comes after that. As far as I'm aware, most tools that handle digital signing don't actually match the signatures. What happens is that a manual check is/can be done by the company receiving the signed document. You rely on the preceding steps to ensure that the person signing is allowed to.

If all you want is to encourage people to make it look similar, just tell them with a help text, but don't punish them if it's looking a bit shoddy.

Improve this answer
6
  • 5
    During the recent lockdown, when I received a package, the delivery service asked me if it was alright if they signed instead of me. As such, I assume the signature is really just pro-forma and it's more of a legal thing than really a technical one.
    – MechMK1
    May 15, 2020 at 8:34
  • We've done the digital signature stuff in part of out software and it's only there because it is required. Nobody ever uses it for anything else then maybe visual check. Main reason is because it is practically impossible to write the same signature as using pen on paper by using slick plastic pen on slick plastic sensor board, unless you've previously trained it for quite some time.
    – mishan
    May 15, 2020 at 11:03
  • 2
    Worse than that @mishan - the screens on dedicated devices often don't have the resolution to accurately represent a reasonably complicated signature at all well; whole features merge. Even new devices use resistive touchscreens which require a fairly steady pressure, so I end up with gaps too
    – Chris H
    May 15, 2020 at 16:16
  • I’ve seen a few which just say “this tick box takes the page of a signature”. I don’t know if it’s legally watertight but it makes sense.
    – Tim
    May 16, 2020 at 18:36
  • 1
    @R..GitHubSTOPHELPINGICE one nice thing about resistive touchscreens is that they work with cheap styluses. Also, that you have to dedicate to actually press the screen is also a bonus of sorts that prevents some unwanted input.
    – John Dvorak
    May 17, 2020 at 11:54
20

My signature is basically habit and muscle memory from repeatedly writing my name with a generally standard sized pen. It varies a bit at the best of times. Even if you ask me to sign on a whiteboard using a marker, that varies a fair bit from my "normal" signature due to the implement being a different size. When I've signed for stuff in the past using a stylus on a touchpad, it doesn't look a lot like my usual signature.

If you ask me to finger paint my signature, it's going to look very different again. All you can tell from matching based on that is how good I am at copying my usual signature in a different medium. Which is probably no better than a random stranger, given the ID card to work from (actually, I'm terrible artistically, so I'd probably be worse at it).

If you asked me to provide a couple of samples of a finger signature at the same time as I provided the ID card, and then used those for comparison later, that would probably be a closer indicator than trying to get me to match my pen signature?

Improve this answer
2
  • 4
    Even with a stylus, the screen quality, sensitivity and degradation are very important. I usually have to sign DHL packages, and my signature is a bunch of squiggles, at best. It is almost never callibrated, people write on it as hard as they do on paper and the whole thing doesn't like curved lines. Trying to get a signature with the tip of the finger will just be a blobby mess.
    – Ismael Miguel
    May 15, 2020 at 14:27
  • 1
    Also, screen quality, sensitivity and degradation matter when it comes to both sides of the signature comparison. The machine I signed on at the government office that produced my ID card was also poor quality. Even if the user has a fantastic signature capture system available now, you don't know how much of a mess their ID card signature could be.
    – Zach Lipton
    May 17, 2020 at 1:56
13

Can we start with the obvious: Why?

Follow up questions:

  • Are you assuming your app has the same legal power as a "wet signature"? You may be in for a surprise!

  • Do you have anybody on staff who is a handwriting expert?

  • Have you seen what other "industry standard" applications do? E.g. Docusign, credit card readers?

Improve this answer
7
  • 3
    "Are you assuming your app has the same legal power as a "wet signature"? You may be in for a surprise!" While I am with you with this, I have to say, you can never know what suprised some jurisdictions have for you. Remember, this is a world wide plattform. I've encountered multiple questions that asked for something that would have been legal at my place but non-legal binding in the country of the person asking the question, and vice versa. Let the lawyers deal with the legal stuff, and rather answer his question :)
    – marvinpoo
    May 15, 2020 at 7:24
  • 1
    I'd be more surprised if there were no jurisdictions in which an application asking for a signature to confirm identity would not be equivalent to a traditional pen-and-paper signature.
    – MechMK1
    May 15, 2020 at 8:35
  • 2
    You remind me of a tale my father used to tell. An old-fashioned equivalent: Customer wanted to design a system with a faxed signature to confirm significant transactions. He faxed back a reply saying it was a bad idea - apparently signed by the customer (in reality a quick and dirty demonstration of how easy it is to fake a signature over a low-quality medium)
    – Chris H
    May 15, 2020 at 16:19
  • Welcome to UX.SE! Thanks for the answer! You bring up some very relevant questions. It may also be helpful to answer or otherwise elaborate on some of them. For example, what legal power does a digital signature typically carry? How have the industry leaders addressed these issues? Are there patterns they've been able to employ that may help OP?
    – maxathousand
    May 15, 2020 at 20:29
  • @ChrisH the difficulty of faking a signature is pretty low no matter what the medium - the power is in most people not being willing to lie under oath about it, rather than any difficulty forging it
    – Tim
    May 16, 2020 at 18:41
1

I wouldn't, for a number of reasons:

  • What you're asking for is likely to be no more legally binding than just having the user sign with their
  • It's never going to match their identity documents. Touchscreens are just too inaccurate, especially when you make them use a finger.
  • Actually verifying this will require a photo of the user's identifying documents. This results in two secondary reasons:
    • By requiring a photo of the user's identifying documents, you significantly raise the expectations of them being who they say they are. You can go even further by requiring your app to take the photo each time they 'sign' something.
    • Assuming you go this route, and someone attempts a forgery, it will actually be easier because they will either have the identifying documents to work from, or they will provide false documents that they can make exactly match what they signed with.

The correct approach here is to have the user 'sign' by providing proof of identity other than a manually entered signature. In most jurisdictions, it's the act of signing that matters, the signature is just used to record that act, so this will (most places) still be valid provided you have the app cryptographically timestamp the signature (or use a secure time-stamping service) to prove when it happened.

Improve this answer
0

There are 2 ideas here:

Idea 1:

  1. I think first your will need a photo of their id.
  2. A photo of their signature on their ID in case the camera performance is bad.
  3. Overlap the 2 photos and see if they match.
  4. Present a guidance photo with 50% opacity to the user for their signature. This way you make sure they will know they have to mimic that.

Cons: This will be really hard to imitate your signature with the one you have on your ID. This can be a big friction point for your users.

Idea 2:

  1. Photo ID.
  2. A photo of their signature on their ID in case the camera performance is bad.
  3. Overlap the 2 photos to make sure it's the same signature.
  4. Ask them to do a selfie with a signed piece of paper. This way you validate identity with the ID card and signature too.
Improve this answer
3
  • Thanks a lot for your response. The thing is we already have the ID photo in the data user info, as it is required for the registration. So, at the moment of signing a contract, we only need this finger sign. We now have a copy telling "hey, be sure the sign is similar", but small, maybe. I'm thinking of adding, once the user signs and continue, a modal skin "Is the sign similar to...?". Aggressive, but maybe effective...
    – Vicepresidente de diseño
    May 14, 2020 at 9:11
  • Why not take the signature with a crop from the ID and get the finger scan from the user to approve the signed contract?
    – Lonut
    May 14, 2020 at 10:21
  • 6
    I repeat myself here: Requesting the user to create an identical signature in a different environment can create a lot of friction.
    – Lonut
    May 14, 2020 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.