Digital signatures were designed to allow secure, confidential communication between two parties.

As Wikipedia describes it: “A user may digitally sign messages using his private key, and another user can check that signature (using the public key contained in that user’s certificate issued by a certificate authority). This enables two (or more) communicating parties to establish confidentiality, message integrity and user authentication without having to exchange any secret information in advance.”

Are digital signatures legally binding? Usually. Check your local statutes.

Are they foolproof? Not usually.

For years, Prof. Ferenc Leitold of the University of Veszprem has been explaining the dangers of digital signatures to the world at large. This week, he’s doing it again at the 15th EICAR Annual Conference in Hamburg, Germany.

The problem revolves around general purpose personal computers. Once an attacker penetrates a PC, any knowledge transferred through that system is friable.

For example, the alphanumeric characters you see on your computer screen are not graphics. Instead, they are typically fonts residing on your system that are called by the application software charged with displaying or printing a page.

By redirecting application font requests or replacing the onboard font set, an attacker or virus can change the meaning of a document without regard to the status of any digital signatures. Font substitution software is readily available on the web.

Leitold adds that, since BSD, Linux, OSX, Windows and other operating systems all grab fonts off their local file systems, they are all more-or-less equally vulnerable to font-jacking.

This would be true, if all operating systems were equally penetrable. But of course, they are not.

He also notes that firewalls configured to let encrypted messages pass through unhindered can also let encrypted malware pass, as long as it’s using the recipient’s public key.

So how can you protect your general purpose computer from malevolent digital signatures?

Leitold says you can’t, as long as the computer itself is not secure. To that end, he recommends that you keep your firewall and antivirus software up-to-date, and develop a solid security policy.

Whenever practical, your primary firewall should be a separate device guarding the network border. That’s especially important when using a Windows-based computer, as hackers report that they are easily breached.

The same goes for email protection. A standalone device or service can be configured to knock out most malware before it ever gets a chance to infect your computer.

Both devices help you set a protective security policy that, Leitold suggests, should include accepting only non-editable, graphic-style documents via email, wherein the the alphanumerics are just arrangements of bits on the page… if you can stand it. Imagine how useful email would be if every message was a graphic you couldn’t edit, paste or search. Yuck.

Other standard security procedures include encrypting your local hard drives, not sharing local folders and never running your computer as Administrator, except as needed. Penetrators can’t commandeer what they can’t see.

As for getting digital signatures… a signature is designed to prove you are you. It’s only as good as the outfit that issued it. While Comodo, Entrust, and Verisign are well-known issuers, prices vary wildly. And Comodo even offers signatures totally free for personal use.

Email Battles Backgrounder: