IWETHEY v. 0.3.0 | TODO
1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User
IWETHEY Banner

Welcome to IWETHEY!

New Futile
If it can be printed, it can be doctored. I've done it as a joke, tabloids do it as a business method. Any half-decent retouching artist with a scanner, editing software and printer can do it. Unless you control the printing and use watermarking, holograms or some other anti-conterfeiting technique, this is not a technical question but a managment/business process one.

-- Or --

Hmm, you could always combine the key figures on the printout with some private key, make the MD5 hash and print that on the page. If the key doesn't match the result from the printed numbers, you'll know it's doctored.

Okay, so the first paragraph should read, "Just because it's in a bar code doesn't mean people can't forge it. If you can figure out how to print bar codes, so can they."
This is my sig. There are many like it, but this one is mine.
New Barcode just used to mask the signature...
Want to run the text (including the numbers) through a hash. A barcode looks nicer and a bunch of random bytes, but I'll have to sit down and figure out whether it can hold enuf of the signature.

The problem is definitely not unique to the web. I figure the same issue has cropped up with printed reports. Figured someone might have dealt with the issue of detecting whether a document has been doctored.
New Almost :)
Swap the use of the hash and the signing algorithm: compute a secure hash of the critical information, then sign the hash with a public key algorithm, using the private key. Have the server publish the signed hash and the public key (as a barcode graphic or otherwise) as part of the page.

Presence of the public key allows the client to verify that the hash represents the critical information.

However, note that barcoding the signed hash and the key only improves part of the problem. If a complaint arises, someone will still be stuck keying in the numbers that were included in the hash in the right order and without typos.
     Signing web pages... - (ChrisR) - (6)
         Barcode Generators - (altmann) - (1)
             Thanks. Will take a look. -NT - (ChrisR)
         Futile - (drewk) - (2)
             Barcode just used to mask the signature... - (ChrisR)
             Almost :) - (scoenye)
         Puzzle. Forensics? chain of evidence? - (Ashton)

If I wanted conversations like that, I'd talk to my girlfriend on the phone.
73 ms