4 ms·

doesn't private key signature guarantee authenticity even if you control the db where signed documents are stored? you know the public key and can check if docu

doesn't private key signature guarantee authenticity even if you control the db where signed documents are stored? you know the public key and can check if document was signed with private key of signer.

cosmojg 5y ago
What are the odds that the client has a verifiable private key?
celtain 5y ago
At least 99% of the people signing documents won't have a public key that anyone else can verify. Even if you help them generate one, they'll probably forget about it and you'll be the only one with a record of it, so once again we're left having to trust that you didn't tamper with your records.
hedora 5y ago
In particular, the business could sign the version it sends to the consumer, and the consumer wouldn’t even have to know about it (pdf’s support attachments). I get the feeling this whole business could be wiped off the face of the earth by an open source hobby project and an enterprise sales team.
- ushakov 5y ago
  EU has it's own open-source Digital Signature service https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/Digital+Signature+Service+-++DSS https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/Digi...
krisoft 5y ago
Yes. Now try to select a thousand random people from all walks of life and see how easy it is to get them to get them to generate a public private key pair amd sign a document with it.
- kaetemi 5y ago
  It's included on the national id smartcard in several EU countries.
  - krisoft 5y ago
    I’m a very technical person, and a citizen of an EU country. I have no idea if my national ID card can do that. Even if it can do that I don’t have a card reader to push it in, and I don’t know what software I would need to sign a document with it. I can figure out all of the above, after all I am paid to figure out things about computers. Can everyone do it? The older gentleman who drives a taxi? The nice lady who edits non-fictional books? The dancer, the barista, the construction worker, the pilot? I don’t have an opinion on what the value of DocuSign’s business should be. I think they have an easy to replicate service with a very shallow moat. But that doesn’t mean that they don’t provide a service to people.
    - number6 5y ago
      In the EU there is this qualified electronical signature. It is legally binding like a handwritten signature and has to be accepted everywhere in the EU. Some EU country issue them via ID card. But you can get one for free by using https://www.zealid.com/en/ https://www.zealid.com/en/ They have a app where you can sign PDFs for free. Everywhere else a QES can cost up to 150€
      - candiodari 5y ago
        > has to be accepted everywhere in the EU So you mean it's got 10x less legal weight than the Schengen accords, that guarantee you won't have a passport check going on or coming off a intra-EU flight in France? Good luck with that. Both France and the Netherlands have both had their council of state decide, relatively recently, that violating EU agreements does not violate EU agreements. I mean it's commercial law, so there is no high burden of proof in the first place, so I'm not so sure what these signatures add in the first place, but the fact that the EU decided something doesn't seem to carry much weight anymore.

cosmojg 5y ago

What are the odds that the client has a verifiable private key?

celtain 5y ago

At least 99% of the people signing documents won't have a public key that anyone else can verify. Even if you help them generate one, they'll probably forget about it and you'll be the only one with a record of it, so once again we're left having to trust that you didn't tamper with your records.

hedora 5y ago

In particular, the business could sign the version it sends to the consumer, and the consumer wouldn’t even have to know about it (pdf’s support attachments). I get the feeling this whole business could be wiped off the face of the earth by an open source hobby project and an enterprise sales team.

ushakov 5y ago
EU has it's own open-source Digital Signature service https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/Digital+Signature+Service+-++DSS https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/Digi...

krisoft 5y ago

Yes. Now try to select a thousand random people from all walks of life and see how easy it is to get them to get them to generate a public private key pair amd sign a document with it.

kaetemi 5y ago
It's included on the national id smartcard in several EU countries.
- krisoft 5y ago
  I’m a very technical person, and a citizen of an EU country. I have no idea if my national ID card can do that. Even if it can do that I don’t have a card reader to push it in, and I don’t know what software I would need to sign a document with it. I can figure out all of the above, after all I am paid to figure out things about computers. Can everyone do it? The older gentleman who drives a taxi? The nice lady who edits non-fictional books? The dancer, the barista, the construction worker, the pilot? I don’t have an opinion on what the value of DocuSign’s business should be. I think they have an easy to replicate service with a very shallow moat. But that doesn’t mean that they don’t provide a service to people.
  - number6 5y ago
    In the EU there is this qualified electronical signature. It is legally binding like a handwritten signature and has to be accepted everywhere in the EU. Some EU country issue them via ID card. But you can get one for free by using https://www.zealid.com/en/ https://www.zealid.com/en/ They have a app where you can sign PDFs for free. Everywhere else a QES can cost up to 150€
    - candiodari 5y ago
      > has to be accepted everywhere in the EU So you mean it's got 10x less legal weight than the Schengen accords, that guarantee you won't have a passport check going on or coming off a intra-EU flight in France? Good luck with that. Both France and the Netherlands have both had their council of state decide, relatively recently, that violating EU agreements does not violate EU agreements. I mean it's commercial law, so there is no high burden of proof in the first place, so I'm not so sure what these signatures add in the first place, but the fact that the EU decided something doesn't seem to carry much weight anymore.