Slashdot Mirror
House Nixes Digital Signature Bill
Seth Scali writes "The Electronic Signature in Global and National Commerce Act was nixed by the House of Representatives on Monday. According to the article over at ZD Net, the vote was 234 to 122-- or about 1/2 of what would be needed to pass." It needed a 2/3 majority. Most Congressmen seem to agree that we need some sort of legally binding digital signature capability, but say they don't think the current proposal offered enough security or consumer protection. Oh, well. Maybe next time.
This is a very good thing, it is bad enough that somebody could steal my credit card or other personal information. Think of what damage could be done when somebody could have that much more credit to masquerade as you...
Just like Microsoft, the government can't be wrong *all* the time.
This space for sale
I would hope that such a bill would be rejected. While there does need to be at some point some form of legally binding electronic signature, I don't think we're at the point where we have the technology to really support this. A normal signature and its individuality is based on the indiosyncrasies and mannerism of each human being and their fine motor systems, and requires a lot of practise if you ever hope to copy it, an electronic signature however, is merely a piece of data, which at this point is far too easily replicated and misused. The current technology just has too many security holes to allow it to be a viable alternative as an individual authentication device.
The House passed the bill in question (It only takes 218 votes for a majority in the House, and this bill got 234). It won't become law because the President will veto it, thus the need for a 2/3rds majority to override. It's misleading to say that the House killed the bill.
BTW, I really hate it when articles quote blatant spin as if it were actually newsworthy.
Anything worth doing is worth doing badly.
A GPG digital signature is currently nearly 100% authenticatable.
A digital signature used to sign a document is both specific to that document and specific to that sender. If it was sent by the wrong person, the signature will be invalid. If the data changes between the time of signing and the time of verifying, the signature becomes invalid.
Try playing with GPG [http://www.gnupg.org] for yourself. It's an extremely neat app.
-- The act of censorship is always worse than whatever is being censored. Always.
I think there is a need for legally binding digital signatures, but its something I wouldn't want to see rushed through the legislature to make some withered old republicans look digitally saavy. This could have disastorous effects.
Any legislation has to be written realizing that protocol or key length requirements need to change with time. A given protocol and keylength may be fine for early November 1999 but may be cryptographically weak in early November 2009. This brings up another point. The protocol and key length requirements need to be strict enough that the chances of them being compromised before the signature on the document no longer protects anything is vanishingly small. In other words the strength behind the signature is directly proportional to the lifetime of the document.
Consider an earnings report for a company for a given quarter. It only requires a years worth of strength in its digital signature. If a third party were to release an October 1998 earnings report in an attempt to manipulate the stock price it would be quickly caught and discredited.
Consider an individual taking out a 30 year mortgage on their home. If the digital signature can be forged in under 30 years this puts the consumer who took out the mortgage at risk. A malignant mortgage company could change interest rates or terms of the agreement to profit at the expense of the consumer. Things like this happen now with pen and paper signatures.
The security requirements for taking out a second thirty year mortgage after the first could be different than those for the first. Technology has increased, computers are faster and maybe new hiccups like quantum computation are a reality.
Digital signatures have the capability of being many orders of magnitude safer than pen and ink signatures if and only if people aren't legistated into weak signatures.
Technophobia isn't rampant there, but skeptisism towards large companies who try to worm their way out of accountability is.
How does this affect digital signatures? Well, unless there is a -close- to 100% foolproof way of authenticating a digital signature, we're just going to run into the same old hastles we're having now, where signatures are forged or copied, or transactions deliberately tampered with or fabricated.
IMHO, digital signatures =must= be coupled with user input which is simply too complex to forge. Using a random sampling of the retina as a one-time pad would work for this. Then use the pad to encrypt the signature, and any other data.
But that only gives you a measure of security against outsiders. What about dodgy bank employees? There, encryption is useless, as the bank has to have the decryption key to be able to make use of the data. At -some- point, in the bank, the information has to be in the clear, and all someone has to do is inject false data there.
Actually, there's a way to solve that, too. If the bank's software is "incomplete", and your signature includes self-decrypting executable code, which is necessary to complete the transaction, it would be necessary to obtain that code before false transactions could be made in your name. However, if this code requires a "ping" or "traceroute" to your card, before it will work, it would be beyond most employees to fake a response. It doesn't make it impossible, but that's not the point. At present, any bank clerk with an IQ of -5, who can tell the difference between a keyboard and a ham sandwich has 99% of the tools they need to do a phantom withdrawl. Make it hard enough, and the people left who still could would probably be earning so much that they wouldn't bother with such petty cash.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
House Republicans intend on bringing this bill back up for a vote before the end of the current congressional session. When you consider it was rushed to the floor and missed being approved by only 4 votes (where did that "about 1/2 of what would be needed to pass" come from?) you can understand their optimism in trying again. This time, instead of bringing it up on the suspension calendar (with the required a 2/3rds vote) they will try to run it through the rules committee and get a "closed rule" on the bill, meaning no amendments to it on the floor. That way they only need a simple majority to pass it.
If the House is going to go down this route, look for it to happen by Friday. But with Lott saying the target adjournment date is Nov. 10, you can be fairly certain this bill will expire with the session (unless they manage to get it appended to a year-ending omnibus appropriation bill, then anything goes . . . ).
In the news I read, the reasons given for nixing Digital Signatures had to do with creating a second class of enforceable, legally binding contracts. I wholeheartedly agree with this. There is no sense in rushing into a new use of technology and forcing it down the throats of consumers who will not understand the message they are receiving. Contract law is one area that is clear enough for a great many people to understand. It is well thought out and well documented in the Uniform Commercial Code and a great many state laws.
This applies to a whole huge list of transaction types and contract law situations.
As much as I love technology and all the cool benefits of it in terms of information flow, I think that for something as important as this, it's imperative that the plan be well thought out and understood by even those who do not understand the underlying technology. It was prudent to wait.
So, who cares about key length? Really. If the consumer will not even understand they are entering a legally binding agreement or receiving information which legally binds them, then we are not ready as a society to take the step. It's really as simple as that, and all the different arguments about the technological merits of one solution vs another can just sit by the wayside until these larger issues are worked out and understood.
If that doesn't take place first, then passing a digital signature act will be something the goverment does to us, not for us.