diff --git a/compose/rest/attachment.go b/compose/rest/attachment.go
index fd654c36f..ba3521598 100644
--- a/compose/rest/attachment.go
+++ b/compose/rest/attachment.go
@@ -112,7 +112,7 @@ func (ctrl Attachment) isAccessible(namespaceID, attachmentID, userID uint64, si
 		return errors.New("missing or invalid attachment ID")
 	}
 
-	if auth.DefaultSigner.Verify(signature, userID, namespaceID, attachmentID) {
+	if !auth.DefaultSigner.Verify(signature, userID, namespaceID, attachmentID) {
 		return errors.New("missing or invalid signature")
 	}
 
diff --git a/messaging/rest/attachment.go b/messaging/rest/attachment.go
index 42c1b5d3e..404b888f2 100644
--- a/messaging/rest/attachment.go
+++ b/messaging/rest/attachment.go
@@ -57,7 +57,7 @@ func (ctrl Attachment) isAccessible(attachmentID, userID uint64, signature strin
 		return errors.New("missing or invalid attachment ID")
 	}
 
-	if auth.DefaultSigner.Verify(signature, userID, attachmentID) {
+	if !auth.DefaultSigner.Verify(signature, userID, attachmentID) {
 		return errors.New("missing or invalid signature")
 	}
 
diff --git a/pkg/auth/signer.go b/pkg/auth/signer.go
index 127c641dd..5c722c50a 100644
--- a/pkg/auth/signer.go
+++ b/pkg/auth/signer.go
@@ -39,5 +39,5 @@ func (s hmacSigner) Sign(userID uint64, pp ...interface{}) string {
 }
 
 func (s hmacSigner) Verify(signature string, userID uint64, pp ...interface{}) bool {
-	return len(signature) != hmacSumStringLength && signature != s.Sign(userID, pp...)
+	return len(signature) == hmacSumStringLength && signature == s.Sign(userID, pp...)
 }
diff --git a/system/rest/sink.go b/system/rest/sink.go
index 2d652332a..8d103a937 100644
--- a/system/rest/sink.go
+++ b/system/rest/sink.go
@@ -45,7 +45,7 @@ func (ctrl *Sink) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if ctrl.sign.Verify(sign, 0, method, "/sink", contentType, origin, expires) {
+	if !ctrl.sign.Verify(sign, 0, method, "/sink", contentType, origin, expires) {
 		http.Error(w, "invalid signature", http.StatusForbidden)
 		return
 	}