from Hacker News

Ask HN: Why is company letterhead a valid form of auth in 2022?

by tjstebbing on 8/18/22, 7:39 AM with 34 comments

• by londons_explore on 8/18/22, 10:08 AM

  You've gotta split it into 'technical auth' and 'legal auth'.

  Legal auth is simply making sure they can sue you, and/or get you sent to prison if you circumvent their system.

• by ksaj on 8/18/22, 9:21 AM

  I have as well. Even a really long time ago, so it sounds like a long lasting habit.

  It reminds me of how lawyers are happy to accept signatures by fax. You could be a rather lousy forger, yet because of the huge and extremely black pixels, still make a passable forged signature over fax. You can even tape a real signature on the page, or make numerous corrections, because the resolution simply cannot show any of those details. There is not much one would consider reliable about a faxed document.

• by jiveturkey on 8/18/22, 7:48 AM

  Twitter is one (of several) companies that have used your required phone number for marketing purpose. How is it you think they have any care about best practices?

  Anyway, this is about shifting liability with minimal effort. As such, I'd consider it best practice. Of course, I'm using that term in a different way than you, but you just need to appreciate the goal here. It's not at all about "authenticating" you as a heretofore unknown, authorized member of the org -- that's extremely difficult, even at small scale.

• by Anderkent on 8/18/22, 11:41 AM

  It takes pretending to be someone you're not from 'a prank' to 'fraud', and as such is actually valuable

• by sokoloff on 8/18/22, 9:27 AM

  I’ve been particularly amused by this, given that I work at a company which prints BCs and letterhead.

• by outsidetheparty on 8/18/22, 5:02 PM

  I mean... we still use physical signatures, too. Old habits die hard.

  But I suspect this has a lot more to do with proving that you are explicitly representing yourself to them as a member of the organization; not proving that you actually are part of the organization.

• by refurb on 8/18/22, 12:16 PM

  What do you propose they ask for instead?

  Plenty of "open source projects" are nothing more than some informal group working together. It's not like they are registered with the government.

• by dazc on 8/18/22, 7:51 AM

  Same way a passport is, I guess? 99% of organisations that ask for a passport image have no way of knowing whether it is fake or not, a letterhead is slightly easier to mock up though.

• by aborsy on 8/18/22, 8:02 PM

  Keybase had a good system for authentication. You link your public key to multiple accounts, and use private key to prove your identity.

  That seems more secure than physical signatures and letter heads, that can presumably be easily forged.

  But Keybase seems not developed anymore. Does anyone know what’s the situation?

• by ggm on 8/18/22, 7:56 AM

  BGP speakers still discuss "letter of authority" despite RPKI being a thing for a decade.

• by skywhopper on 8/18/22, 12:01 PM

  Simple answer is: Because there is literally no way to do it, and this used to be a reasonable approach before cheap hi-res printers became available.

• by tiahura on 8/18/22, 1:04 PM

  Can you cite examples of this method of authentication being defeated?

• by LatteLazy on 8/18/22, 10:22 AM

  Because it was the best idea someone had in 1950. And humans don't learn, you just wait for the old ones to die and new ones to enter the workforce with new ideas.

• by freedude on 8/18/22, 3:16 PM

  A better question might be why is a company considered a legal entity or even a technical entity? It has been said that they shouldn't be and that legality should rest with the individual companies' owner. This of course would end corporations and much of the crap they produce and force owners to be accountable to their word. Yes, a novel concept.

  But don't take my word for it. Read what Adam Smith had to say about it first in the Wealth of Nations. https://www.ibiblio.org/ml/libri/s/SmithA_WealthNations_p.pd...