7 ms·

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastl

by D13Fd 3y ago

> For documents of prime importance, such as contracts and invoices Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. Why? Because it has worked that way for hundreds of years. It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic signature solutions don't necessarily solve it.

layer8 3y ago
At least in Europe, electronic signatures of a certain form are legally equivalent to handwritten signatures [0], and are increasingly used as such. Emails don’t provide that legal value. [0] https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS
- cedilla 3y ago
  I agree, in Europe digital signatures are very common now. Although at least for me it's almost exclusively PDFs.
- londons_explore 3y ago
  > Emails don’t provide that legal value. In general, agreeing to something by text in an email is as legally enforceable as a signature.
  - logifail 3y ago
    > In general [..] ...but apparently not always. Not something I'd want to bet my business or reputation on. "AUSTRIA’s Federal Administrative Court [..] declared a framework contract from Austrian Federal Railways (ÖBB) to Stadler for the delivery of up to 186 double-deck trains to be null and void due to an alleged formal error in the qualified electronic signature of the offer." (September 2021) https://www.railjournal.com/news/austrian-court-annuls-stadlers-obb-train-contract/ https://www.railjournal.com/news/austrian-court-annuls-stadl...
    - c00lio 3y ago
      That is about a public tender, where there are "form requirements", meaning that certain documents and signatures have to conform to the required form. Usually that means "in writing, on paper, with signatures made by hand" or the new legally accepted replacement of secure electronic signatures. Sometimes it might even mean signing the paper in front of a notary, e.g. for contracts regarding the sale of real estate. But in general, outside clearly defined exceptions, contracts and declarations do not have a form requirement, so even oral agreement or "conclusive behaviour" (sign language, point-and-grunt, silently carrying an item to the cash register) are absolutely valid. Of course, when in doubt, proving the exact content of such an unwritten contract may be hard.
      - D13Fd 3y ago
        > But in general, outside clearly defined exceptions, contracts and declarations do not have a form requirement, so even oral agreement or "conclusive behaviour" (sign language, point-and-grunt, silently carrying an item to the cash register) are absolutely valid. Correct in the US, although it's worth mentioning the Statute of Frauds and the Uniform Commercial Code: https://en.wikipedia.org/wiki/Statute_of_frauds https://en.wikipedia.org/wiki/Statute_of_frauds https://en.wikipedia.org/wiki/Uniform_Commercial_Code https://en.wikipedia.org/wiki/Uniform_Commercial_Code
- ogig 3y ago
  True, our company constantly use certificate based signatures, and government agencies emit most documents with the same method, almost always on pdfs. Tho most people tend to use AutoFirma, a java program written by the government for signing and checking signatures validity. I would love to see it thoroughly audited too.
- tpurves 3y ago
  I think the main point the parent comment is making is that, today and historically, the great majority of contract disputes today don't involve disputing (analog or digital) signatures. People usually dispute about all the other terms rather that about the act of having signed it. [Even though analog signatures aren't particularly secure either] However, if Microsoft signatures have now became more forgeable at scale, perhaps we could see some rash of fake contract fraud in the future where disputing fact of signature becomes more common.
  - deleted 3y ago
    [deleted]
  - ClarityJones 3y ago
    The question of signing generally arises with dueling forms, where there's no dispute that "a" 20-page contract was signed on June 4, 2017, and that this is page 20, with all of the signatures, but... What did that contract say in Paragraph G on Page 12? Perhaps the bank only retained page 20, and is saying that they used the same master form for every mortgage and the master form says "this" on page 12. Or one party discovers that other has misplaced their copy of the contract and then shows up with a copy that has advantageous wording on page 12.
    - wongarsu 3y ago
      On "serious" contracts, it's common to put your initials on each page, or to fan out the stack of papers and sign the margin so that each page contains part of that signature. Both are in addition to the "real" signature at the end, and provide some protection against exactly these kinds of problems. I guess a cryptographer would add a hash of all preceding pages on the last page.
      - CuriousCosmic 3y ago
        > I guess a cryptographer would add a hash of all preceding pages on the last page. That's basically how hashes and signatures work anyways. They basically take in the result of the previous block and integrate it into the new block so that if you change any part of the previous parts, the whole thing breaks. Edit: I should specify this is how the algorithms themself work. Implementations can fuck this up (and they do a lot).
- c00lio 3y ago
  EIDAS isn't worth the paper (pun intended) it is written on, if insecure "click a link in an email"-signature schemes such as https://help.eversign.com/hc/en-us/articles/6664408666013-Is-Xodo-Sign-Legally-Binding- https://help.eversign.com/hc/en-us/articles/6664408666013-Is... can claim compliance...
  - 1MachineElf 3y ago
    Disclaimer: I'm not familiar with this service or EIDAS, so my comment might be entirely off the mark. The decision to require users to use an emailed link to view and sign a message could stem from DLP requirements. Emails are plain-text and therefore any sensitive data leaked could be irreversibly exposed. By keeping the messages inside a system that requires authentication, there is less likelihood that a someone besides the intended recipient will interact with the message. Such systems also support auditability and DLP scanning.
  - layer8 3y ago
    I don’t know where you’re taking “click a link in an email” from, but that’s decidedly not how eIDAS works. The private keys must be hardware-protected and under the sole control of an identified signer, which usually means either a physical token or a 2FA-protected remote key in an HSM. In addition, a prior ID verification procedure like video ID or a face-to-face verification is required.
    - c00lio 3y ago
      Well. Eversign holds the key and promises to only use it when you authenticated by clicking the link in the email that was sent to you personally. eIDAS was intentionally formulated to allow such signature services, making the whole thing quite pointless from a security perspective.
      - layer8 3y ago
        Service providers must undergo audits to ensure that the security measures they take meet the eIDAS requirements. This includes strong protective measures against unauthorized access to private keys. The keys are usually unrecoverable when the end user has lost their credentials. It’s actually quite involved and costly to become such an accredited provider.
- psychphysic 3y ago
  In the UK at least it you email agreeing to terms and then appear to be complying you're unlikely to get out of it. Common examples are someone is sent a contract of employment unfortunately often after starting and they don't sign it. If they have been coming into work broadly in line with that contract so long as it's fair, employee and employer are bound by it. Here is an interesting edge case in the UK [0]. Long story short if you give someone the ability to sign on your behalf and appear to consider parties bound by that it's binding. In a personal sense, I send out appointment letters but my secretary does it for me. I consider myself as bound to that as if I arranged it myself. I gave the secretary latitude to book appointments for me, and I usually turn up to those appointments. If that letter is signed, or if it's by my hand. Doesn't legally matter as much as you'd imagine. [0] https://www.lexisnexis.co.uk/blog/banking-and-finance/gordon-ramsay-bound-by-ghost-signature-of-guarantee https://www.lexisnexis.co.uk/blog/banking-and-finance/gordon...
  - justincormack 3y ago
    "An Englishman's word is his bond" as the old saying goes, verbal contracts are enforceable. The whole financial system used to run on purely verbal contracts. There are some requirements, there has to be a consideration for example. I am not sure this is true in other legal systems though.
    - zzbn00 3y ago
      As an interesting edge case, in an auction contract can be formed without words either: it is formed on the "fall of the hammer" https://www.legislation.gov.uk/ukpga/1979/54 https://www.legislation.gov.uk/ukpga/1979/54
  - denton-scratch 3y ago
    I don't know about other places; but in the UK, a contract doesn't even have to be written down, let alone signed. Of course, an unwritten contract is no more valuable than the paper it's (not) written on; and either party can dispute the terms. But you can still make a valid contract with a verbal agreement and a shake of hands. But don't do this unless you trust your co-contractor!
- CrampusDestrus 3y ago
  >Emails don’t provide that legal value. In Italy there is an officially legislated signed email service that has legal value
  - dfox 3y ago
    The service probably has nothing to do with email and is only tangentially related to eIDAS. At least that is the case in Czech Republic. One surprising fact about such systems is that they tend to produce blockchain-like audit log and predate bitcoin by several years.
    - necovek 3y ago
      Append-only stores of record predate "blockchain" by decades: a distributed trust/consensus algorithm is the real innovation in Bitcoin.
- bogeholm 3y ago
  I’ve found the per-country overview of general legality of digital signatures on DocuSign [0] quite informative. As an example, in DK an email constitutes a valid contract for most purposes. [0] https://www.docusign.com/products/electronic-signature/legality/global https://www.docusign.com/products/electronic-signature/legal...
  - necovek 3y ago
    Even if I spoof it? ;)
    - bogeholm 3y ago
      Well that’ll most likely be handled as forgery, or ‘Dokumentfalsk’ ;)
  - usr1106 3y ago
    Looks useful. However, when you read the page about Finland it suddenly starts talking about Austria.
- necovek 3y ago
  Which makes attacks like these even worse: Serbian law, for instance, has a clause how you are not allowed to dispute an electronic signature signed using an officially issued eID certificate. While I am sure that clause can be nulled and voided if it came to that, the fact that the responsibility is on the signee is terrible.
- bombolo 3y ago
  In italy we have PEC, which is legally regulated signed emails
galleywest200 3y ago
I have been asked to e-sign pretty much every building/home leasing document involving myself in the past few years in the US. I am sure that this is also the case for thousands, if not millions, of other Americans.
- loeg 3y ago
  Sure, but do you have any indication cryptography is involved in this process? In my (limited) experience as a consumer, they just take some existing PDF and add marks on top of it.
  - tialaramex 3y ago
    Usually the distinction made is between electronic signature (e.g. you scrawled your mark on a piece of paper, scanned it and now the software lets you paste that image on signature pages) and digital signature (cryptographic)
    - phrz 3y ago
      The ESIGN Act makes no distinction in the US between whether you cryptographically sign or digitally draw, etc., defining a signature as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."
      - kjetil 3y ago
        In the EU (and EEA), eIDAS distinguishes between - "electronic signatures", which can be any electronic data used to sign, like a drawn signature - "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.) - "qualified electronic signature (QES), which is a digital signature created by a certified signature device QES is legally equivalent to a "wet signature", but in my experience rarely used because of cost. AdES is much more common for high-trust scenarios like loan applications. For low-trust like package delivery, a signature (or smiley) drawn on a touch device will usually do.
MangoCoffee 3y ago
when i was young i worked for a e-mortgage software company. our flagship software allows customer to sign online or on a electronic signing pad. the whole legality is based on Electronic Records and Signatures in Commerce Act signed by Bill Clinton.
zzbn00 3y ago
Yes, and in fact contract and invoices are bad examples because they involve exchange of something from both sides so denying them is very often a futile task. Better examples would be things like wills and deeds but because they are good examples they have careful witnessing and verification requirements :)
eduction 3y ago
And for thousands of years humans got on with no written contracts at all. That doesn’t change the fact that as society evolves there are good reasons for agreements to evolve with it. I’m sure the first hundred years or so of written contracts there were people rolling their eyes at the idea and others “doing it wrong”. It’s possible (likely?) we’ll reach a point where strong properly implemented digital signatures are considered table stakes. This stuff is hard but probably worth it ultimately.
- D13Fd 3y ago
  > This stuff is hard but probably worth it ultimately. I think you're understating "hard." What about the large proportion of contracts that are still signed in paper? (All of those waivers you fill out at the doctor's office? Paper. Buy a car? Paper. Mortgage? Paper. Hire a contractor for your house? Paper.) Is your scheme going to render those invalid? Are we outlawing paper agreements? Consider also: * Many people do not have a computer or smartphone. * Any scheme (particularly one that does not involve pretty hardcore identify verification) is going to suffer from most of the same limitations as a regular e-signature, in that either side can claim that it wasn't actually them who clicked the button. * Technology changes rapidly and the entities that are most involved in contracts change very slowly. * Corporations have a huge incentive to push back on anything that adds friction to customers signing contracts. Do you think we'll really push through all of that, just to fight the extremely uncommon circumstance where a party denies that they signed a contract? Especially where cryptographic signatures wouldn't even fully solve the problem? I think it's unlikely.
  - eduction 3y ago
    Yes!
ajb 3y ago
The Gazette (the publication of legal record in the UK) does sign things cryptographically: Eg, for example: https://www.thegazette.co.uk/notice/4301705 https://www.thegazette.co.uk/notice/4301705 (see the signatures at the bottom right). Not sure what actual legal function this serves though.
marcosdumay 3y ago
> It's pretty uncommon for there to be a dispute about the fact of signature Well, I disagree. It looks quite common to me. You just won't see it on contract disputes, because that kind of argument is a criminal matter. But false contracts, authorizations, transactions and whatever are really common.
deleted 3y ago
[deleted]
CobrastanJorji 3y ago
Same thing with the notarization system. Is the notary system foolproof? Absolutely not! Imagine how much better notarizations could be with a bit of technology around it. A digital notary could take a photo of your document, register a hash/summary/thumbnail in realtime, and make it so that backdating or changing the document after the fact is a technical impossibility. What do we use instead? A guy who's probably employed by the signatory promises that he stamped the document on a certain date. But here's the thing: the current system works well enough. Sure, as crypto enthusiasts and programmers, we take offense at the current system and immediately start dreaming up notary camera devices with tamper-resistant hardware and image hashes on blockchains and whatnot, but why go and build a fancy, hard-to-fool system unless somebody actually needs it?
- beambot 3y ago
  "The current system works well enough" is a poor justification to avoid technological progress. I imagine people said the same thing about automobiles during the era of horses & buggies... yet here we are. A much better argument is the indelible nature of physical signatures. But even that factor has pluses & minuses in an increasingly-digital world. If anything, we need digital signatures - e.g. to watermark original images, videos, articles, etc in an era of deepfakes.
  - CobrastanJorji 3y ago
    On the contrary, "Progress" is a poor justification for complexity. To justify change, especially change that adds complexity and cost, there needs to be a problem that needs solving or an opportunity to make things better, where better means "cheaper" or "easier" or "simpler" or "fails less." Progress that doesn't make things better for somebody isn't progress, it's Juicero. If there isn't any notarization fraud out there causing expensive problems, then spending a bunch of effort to make notarizations better isn't solving any problems but is adding complexity and cost.
    - beambot 3y ago
      Managing electronic signatures (e.g. DocuSign & file storage) is a 10x improvement for me compared to printing, signing, mailing or faxing, and file cabinets. The complexity & reduced costs are definitely worth it. YMMV.
mschuster91 3y ago
> Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. More and more people in the legal world want to move away from scanned signatures, faxes and other "legacy" elements. Managing paper (and keeping it safe for the time you legally have to store it) is a massive expense for companies. Fires or thefts at vaults are rare but they do happen (not to mention natural disasters like floods), and you don't want to be affected by a breach that ruins stuff as, say, real estate deeds simply because of the headache that entails to get them replaced. In contrast to that, a digital deed can be replaced very fast, no matter if the company or the government loses their data center to a disaster. > It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic signature solutions don't necessarily solve it. Oh there absolutely is. Particularly in America, where all you need to create a bank account and a line of credit is the name of a person, their SSN and some other details that have long since been leaked to some dark web forum and a forged signature. With a requirement for a digital signature, a criminal would additionally have to phish their target's digital signature as well - either by convincing the target to make the digital signature or by stealing it via a RAT. Yes, that's possible, but the human element adds a significant cost increase as the criminal now needs a callcenter somewhere in India, Turkey or other places known for being a scammer heaven.
prepend 3y ago
I really like how preview has an image signature feature now and it seems to pass whenever people need a doc signed. The occurrence of fraud is so low, it’s better to just have non crypto signatures for legal docs and then contest when necessary.
pid-1 3y ago
Not American, but DocuSign is becoming quite popular in my country and was deemed as a legal way of signing documents by courts.
bombolo 3y ago
Uh? I have a smart card that I can use to digitally sign stuff. Fully regulated by law in italy. A scanned signature is not valid for us.
Avamander 3y ago
In some countries digital signatures are used in vast majority of cases, paber being the rare fallback (and nobody scans or faxes those).
bombcar 3y ago
It's been said repeatedly that high-level business deals (think: Manhattan real estate) are done with handshakes, because if you're not worth your word, you're done in the business. You might fight over the terms, but once you say "ok" you're not going to fight over "that wasn't me who signed it".

by D13Fd 3y ago

layer8 3y ago

At least in Europe, electronic signatures of a certain form are legally equivalent to handwritten signatures [0], and are increasingly used as such. Emails don’t provide that legal value. [0] https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS

cedilla 3y ago
I agree, in Europe digital signatures are very common now. Although at least for me it's almost exclusively PDFs.
londons_explore 3y ago
> Emails don’t provide that legal value. In general, agreeing to something by text in an email is as legally enforceable as a signature.
- logifail 3y ago
  > In general [..] ...but apparently not always. Not something I'd want to bet my business or reputation on. "AUSTRIA’s Federal Administrative Court [..] declared a framework contract from Austrian Federal Railways (ÖBB) to Stadler for the delivery of up to 186 double-deck trains to be null and void due to an alleged formal error in the qualified electronic signature of the offer." (September 2021) https://www.railjournal.com/news/austrian-court-annuls-stadlers-obb-train-contract/ https://www.railjournal.com/news/austrian-court-annuls-stadl...
  - c00lio 3y ago
    That is about a public tender, where there are "form requirements", meaning that certain documents and signatures have to conform to the required form. Usually that means "in writing, on paper, with signatures made by hand" or the new legally accepted replacement of secure electronic signatures. Sometimes it might even mean signing the paper in front of a notary, e.g. for contracts regarding the sale of real estate. But in general, outside clearly defined exceptions, contracts and declarations do not have a form requirement, so even oral agreement or "conclusive behaviour" (sign language, point-and-grunt, silently carrying an item to the cash register) are absolutely valid. Of course, when in doubt, proving the exact content of such an unwritten contract may be hard.
    - D13Fd 3y ago
      > But in general, outside clearly defined exceptions, contracts and declarations do not have a form requirement, so even oral agreement or "conclusive behaviour" (sign language, point-and-grunt, silently carrying an item to the cash register) are absolutely valid. Correct in the US, although it's worth mentioning the Statute of Frauds and the Uniform Commercial Code: https://en.wikipedia.org/wiki/Statute_of_frauds https://en.wikipedia.org/wiki/Statute_of_frauds https://en.wikipedia.org/wiki/Uniform_Commercial_Code https://en.wikipedia.org/wiki/Uniform_Commercial_Code
ogig 3y ago
True, our company constantly use certificate based signatures, and government agencies emit most documents with the same method, almost always on pdfs. Tho most people tend to use AutoFirma, a java program written by the government for signing and checking signatures validity. I would love to see it thoroughly audited too.
tpurves 3y ago
I think the main point the parent comment is making is that, today and historically, the great majority of contract disputes today don't involve disputing (analog or digital) signatures. People usually dispute about all the other terms rather that about the act of having signed it. [Even though analog signatures aren't particularly secure either] However, if Microsoft signatures have now became more forgeable at scale, perhaps we could see some rash of fake contract fraud in the future where disputing fact of signature becomes more common.
- deleted 3y ago
  [deleted]
- ClarityJones 3y ago
  The question of signing generally arises with dueling forms, where there's no dispute that "a" 20-page contract was signed on June 4, 2017, and that this is page 20, with all of the signatures, but... What did that contract say in Paragraph G on Page 12? Perhaps the bank only retained page 20, and is saying that they used the same master form for every mortgage and the master form says "this" on page 12. Or one party discovers that other has misplaced their copy of the contract and then shows up with a copy that has advantageous wording on page 12.
  - wongarsu 3y ago
    On "serious" contracts, it's common to put your initials on each page, or to fan out the stack of papers and sign the margin so that each page contains part of that signature. Both are in addition to the "real" signature at the end, and provide some protection against exactly these kinds of problems. I guess a cryptographer would add a hash of all preceding pages on the last page.
    - CuriousCosmic 3y ago
      > I guess a cryptographer would add a hash of all preceding pages on the last page. That's basically how hashes and signatures work anyways. They basically take in the result of the previous block and integrate it into the new block so that if you change any part of the previous parts, the whole thing breaks. Edit: I should specify this is how the algorithms themself work. Implementations can fuck this up (and they do a lot).
c00lio 3y ago
EIDAS isn't worth the paper (pun intended) it is written on, if insecure "click a link in an email"-signature schemes such as https://help.eversign.com/hc/en-us/articles/6664408666013-Is-Xodo-Sign-Legally-Binding- https://help.eversign.com/hc/en-us/articles/6664408666013-Is... can claim compliance...
- 1MachineElf 3y ago
  Disclaimer: I'm not familiar with this service or EIDAS, so my comment might be entirely off the mark. The decision to require users to use an emailed link to view and sign a message could stem from DLP requirements. Emails are plain-text and therefore any sensitive data leaked could be irreversibly exposed. By keeping the messages inside a system that requires authentication, there is less likelihood that a someone besides the intended recipient will interact with the message. Such systems also support auditability and DLP scanning.
- layer8 3y ago
  I don’t know where you’re taking “click a link in an email” from, but that’s decidedly not how eIDAS works. The private keys must be hardware-protected and under the sole control of an identified signer, which usually means either a physical token or a 2FA-protected remote key in an HSM. In addition, a prior ID verification procedure like video ID or a face-to-face verification is required.
  - c00lio 3y ago
    Well. Eversign holds the key and promises to only use it when you authenticated by clicking the link in the email that was sent to you personally. eIDAS was intentionally formulated to allow such signature services, making the whole thing quite pointless from a security perspective.
    - layer8 3y ago
      Service providers must undergo audits to ensure that the security measures they take meet the eIDAS requirements. This includes strong protective measures against unauthorized access to private keys. The keys are usually unrecoverable when the end user has lost their credentials. It’s actually quite involved and costly to become such an accredited provider.
psychphysic 3y ago
In the UK at least it you email agreeing to terms and then appear to be complying you're unlikely to get out of it. Common examples are someone is sent a contract of employment unfortunately often after starting and they don't sign it. If they have been coming into work broadly in line with that contract so long as it's fair, employee and employer are bound by it. Here is an interesting edge case in the UK [0]. Long story short if you give someone the ability to sign on your behalf and appear to consider parties bound by that it's binding. In a personal sense, I send out appointment letters but my secretary does it for me. I consider myself as bound to that as if I arranged it myself. I gave the secretary latitude to book appointments for me, and I usually turn up to those appointments. If that letter is signed, or if it's by my hand. Doesn't legally matter as much as you'd imagine. [0] https://www.lexisnexis.co.uk/blog/banking-and-finance/gordon-ramsay-bound-by-ghost-signature-of-guarantee https://www.lexisnexis.co.uk/blog/banking-and-finance/gordon...
- justincormack 3y ago
  "An Englishman's word is his bond" as the old saying goes, verbal contracts are enforceable. The whole financial system used to run on purely verbal contracts. There are some requirements, there has to be a consideration for example. I am not sure this is true in other legal systems though.
  - zzbn00 3y ago
    As an interesting edge case, in an auction contract can be formed without words either: it is formed on the "fall of the hammer" https://www.legislation.gov.uk/ukpga/1979/54 https://www.legislation.gov.uk/ukpga/1979/54
- denton-scratch 3y ago
  I don't know about other places; but in the UK, a contract doesn't even have to be written down, let alone signed. Of course, an unwritten contract is no more valuable than the paper it's (not) written on; and either party can dispute the terms. But you can still make a valid contract with a verbal agreement and a shake of hands. But don't do this unless you trust your co-contractor!
CrampusDestrus 3y ago
>Emails don’t provide that legal value. In Italy there is an officially legislated signed email service that has legal value
- dfox 3y ago
  The service probably has nothing to do with email and is only tangentially related to eIDAS. At least that is the case in Czech Republic. One surprising fact about such systems is that they tend to produce blockchain-like audit log and predate bitcoin by several years.
  - necovek 3y ago
    Append-only stores of record predate "blockchain" by decades: a distributed trust/consensus algorithm is the real innovation in Bitcoin.
bogeholm 3y ago
I’ve found the per-country overview of general legality of digital signatures on DocuSign [0] quite informative. As an example, in DK an email constitutes a valid contract for most purposes. [0] https://www.docusign.com/products/electronic-signature/legality/global https://www.docusign.com/products/electronic-signature/legal...
- necovek 3y ago
  Even if I spoof it? ;)
  - bogeholm 3y ago
    Well that’ll most likely be handled as forgery, or ‘Dokumentfalsk’ ;)
- usr1106 3y ago
  Looks useful. However, when you read the page about Finland it suddenly starts talking about Austria.
necovek 3y ago
Which makes attacks like these even worse: Serbian law, for instance, has a clause how you are not allowed to dispute an electronic signature signed using an officially issued eID certificate. While I am sure that clause can be nulled and voided if it came to that, the fact that the responsibility is on the signee is terrible.
bombolo 3y ago
In italy we have PEC, which is legally regulated signed emails

galleywest200 3y ago

I have been asked to e-sign pretty much every building/home leasing document involving myself in the past few years in the US. I am sure that this is also the case for thousands, if not millions, of other Americans.

loeg 3y ago
Sure, but do you have any indication cryptography is involved in this process? In my (limited) experience as a consumer, they just take some existing PDF and add marks on top of it.
- tialaramex 3y ago
  Usually the distinction made is between electronic signature (e.g. you scrawled your mark on a piece of paper, scanned it and now the software lets you paste that image on signature pages) and digital signature (cryptographic)
  - phrz 3y ago
    The ESIGN Act makes no distinction in the US between whether you cryptographically sign or digitally draw, etc., defining a signature as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."
    - kjetil 3y ago
      In the EU (and EEA), eIDAS distinguishes between - "electronic signatures", which can be any electronic data used to sign, like a drawn signature - "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.) - "qualified electronic signature (QES), which is a digital signature created by a certified signature device QES is legally equivalent to a "wet signature", but in my experience rarely used because of cost. AdES is much more common for high-trust scenarios like loan applications. For low-trust like package delivery, a signature (or smiley) drawn on a touch device will usually do.

MangoCoffee 3y ago

when i was young i worked for a e-mortgage software company. our flagship software allows customer to sign online or on a electronic signing pad. the whole legality is based on Electronic Records and Signatures in Commerce Act signed by Bill Clinton.

zzbn00 3y ago

Yes, and in fact contract and invoices are bad examples because they involve exchange of something from both sides so denying them is very often a futile task. Better examples would be things like wills and deeds but because they are good examples they have careful witnessing and verification requirements :)

eduction 3y ago

And for thousands of years humans got on with no written contracts at all. That doesn’t change the fact that as society evolves there are good reasons for agreements to evolve with it. I’m sure the first hundred years or so of written contracts there were people rolling their eyes at the idea and others “doing it wrong”. It’s possible (likely?) we’ll reach a point where strong properly implemented digital signatures are considered table stakes. This stuff is hard but probably worth it ultimately.

D13Fd 3y ago
> This stuff is hard but probably worth it ultimately. I think you're understating "hard." What about the large proportion of contracts that are still signed in paper? (All of those waivers you fill out at the doctor's office? Paper. Buy a car? Paper. Mortgage? Paper. Hire a contractor for your house? Paper.) Is your scheme going to render those invalid? Are we outlawing paper agreements? Consider also: * Many people do not have a computer or smartphone. * Any scheme (particularly one that does not involve pretty hardcore identify verification) is going to suffer from most of the same limitations as a regular e-signature, in that either side can claim that it wasn't actually them who clicked the button. * Technology changes rapidly and the entities that are most involved in contracts change very slowly. * Corporations have a huge incentive to push back on anything that adds friction to customers signing contracts. Do you think we'll really push through all of that, just to fight the extremely uncommon circumstance where a party denies that they signed a contract? Especially where cryptographic signatures wouldn't even fully solve the problem? I think it's unlikely.
- eduction 3y ago
  Yes!

ajb 3y ago

The Gazette (the publication of legal record in the UK) does sign things cryptographically: Eg, for example: https://www.thegazette.co.uk/notice/4301705 https://www.thegazette.co.uk/notice/4301705 (see the signatures at the bottom right). Not sure what actual legal function this serves though.

marcosdumay 3y ago

> It's pretty uncommon for there to be a dispute about the fact of signature Well, I disagree. It looks quite common to me. You just won't see it on contract disputes, because that kind of argument is a criminal matter. But false contracts, authorizations, transactions and whatever are really common.

deleted 3y ago

[deleted]

CobrastanJorji 3y ago

Same thing with the notarization system. Is the notary system foolproof? Absolutely not! Imagine how much better notarizations could be with a bit of technology around it. A digital notary could take a photo of your document, register a hash/summary/thumbnail in realtime, and make it so that backdating or changing the document after the fact is a technical impossibility. What do we use instead? A guy who's probably employed by the signatory promises that he stamped the document on a certain date. But here's the thing: the current system works well enough. Sure, as crypto enthusiasts and programmers, we take offense at the current system and immediately start dreaming up notary camera devices with tamper-resistant hardware and image hashes on blockchains and whatnot, but why go and build a fancy, hard-to-fool system unless somebody actually needs it?

beambot 3y ago
"The current system works well enough" is a poor justification to avoid technological progress. I imagine people said the same thing about automobiles during the era of horses & buggies... yet here we are. A much better argument is the indelible nature of physical signatures. But even that factor has pluses & minuses in an increasingly-digital world. If anything, we need digital signatures - e.g. to watermark original images, videos, articles, etc in an era of deepfakes.
- CobrastanJorji 3y ago
  On the contrary, "Progress" is a poor justification for complexity. To justify change, especially change that adds complexity and cost, there needs to be a problem that needs solving or an opportunity to make things better, where better means "cheaper" or "easier" or "simpler" or "fails less." Progress that doesn't make things better for somebody isn't progress, it's Juicero. If there isn't any notarization fraud out there causing expensive problems, then spending a bunch of effort to make notarizations better isn't solving any problems but is adding complexity and cost.
  - beambot 3y ago
    Managing electronic signatures (e.g. DocuSign & file storage) is a 10x improvement for me compared to printing, signing, mailing or faxing, and file cabinets. The complexity & reduced costs are definitely worth it. YMMV.

mschuster91 3y ago

> Few in the legal world actually use cryptographic signatures for signing things. It's vastly more common to use scanned hand signatures or just /s/ and an e-mail record of sign off. More and more people in the legal world want to move away from scanned signatures, faxes and other "legacy" elements. Managing paper (and keeping it safe for the time you legally have to store it) is a massive expense for companies. Fires or thefts at vaults are rare but they do happen (not to mention natural disasters like floods), and you don't want to be affected by a breach that ruins stuff as, say, real estate deeds simply because of the headache that entails to get them replaced. In contrast to that, a digital deed can be replaced very fast, no matter if the company or the government loses their data center to a disaster. > It's pretty uncommon for there to be a dispute about the fact of signature, and even if there is, cryptographic signature solutions don't necessarily solve it. Oh there absolutely is. Particularly in America, where all you need to create a bank account and a line of credit is the name of a person, their SSN and some other details that have long since been leaked to some dark web forum and a forged signature. With a requirement for a digital signature, a criminal would additionally have to phish their target's digital signature as well - either by convincing the target to make the digital signature or by stealing it via a RAT. Yes, that's possible, but the human element adds a significant cost increase as the criminal now needs a callcenter somewhere in India, Turkey or other places known for being a scammer heaven.

prepend 3y ago

I really like how preview has an image signature feature now and it seems to pass whenever people need a doc signed. The occurrence of fraud is so low, it’s better to just have non crypto signatures for legal docs and then contest when necessary.

pid-1 3y ago

Not American, but DocuSign is becoming quite popular in my country and was deemed as a legal way of signing documents by courts.

bombolo 3y ago

Uh? I have a smart card that I can use to digitally sign stuff. Fully regulated by law in italy. A scanned signature is not valid for us.

Avamander 3y ago

In some countries digital signatures are used in vast majority of cases, paber being the rare fallback (and nobody scans or faxes those).

bombcar 3y ago

It's been said repeatedly that high-level business deals (think: Manhattan real estate) are done with handshakes, because if you're not worth your word, you're done in the business. You might fight over the terms, but once you say "ok" you're not going to fight over "that wasn't me who signed it".