5 ms·

Thank you for creating this and making it open source. What mechanism(s) is used to ensure non-repudiation? I appreciate that the demo is not behind a sign up

Thank you for creating this and making it open source. What mechanism(s) is used to ensure non-repudiation? I appreciate that the demo is not behind a sign up wall, but is account creation and email verification required for invitees to sign any documents? Are IP addresses stored as part of the digital signature? Any other mechanism?

somery 3y ago
IP addresses and browser User Agent strings are stored for each signature/submission - those are the only measures for 'non-repudiation' currently available. but i think it doens't differ from other mainstream SaaS solutions - if you read through their terms of services - they put 'non-repudiation' liability on users of their services
- dtx1 3y ago
  Those are both unfortunatly trivially faked
  - infogulch 3y ago
    And yet it's the standard practice for normal people.
    - dtx1 3y ago
      From my research this has 0 legal validity, at least in germany in regards to the EU eIDAS. They are just smoke and mirrors for companies to make them "feel" secure but without cryptographic ensurances (Advanced Electronic Signature) or TLS like Signed Cryptography (Qualified Electronic Signature) this is just as legally binding or not binding as an E-Mail
      - V__ 3y ago
        > just as legally binding or not binding as an E-Mail Which is legally binding. In Germany most contracts are free-form contracts (Formfreiheit) and only need declarations of intent in the form of offer and acceptance. This can be a handshake or even a head shake.
        infogulch 3y ago
        Or perhaps even an emoji reaction in a text chat, as described elsewhere itt.
      - etothepii 3y ago
        Unless you are a qualified lawyer it would be polite to begin a comment like this with IANAL. IANAL but in the common law world a contract requires 3 things: * Offer and acceptance * Consideration (something of value) * An intention to form legal relations. Acceptance is, of course, what a signature signifies. Acceptance is "a matter of fact" and thus in reality pretty much anything will do.
        TheNewsIsHere 3y ago
        Yeah, it’s not like in the spirit of the law you can perform your part of the contract and then get away with saying “I never agreed”. In the US, we have a federal law that covers electronic contract signing. I believe it’s part of the UCC? (I’m not an attorney, and that area isn’t one I practice with in tech either.)
  - _ea1k 3y ago
    Signatures are pretty easy to fake too, because basically noone verifies them. In practice, the security involved only has to reach the "good enough" threshold and not a 100% hack proof level.
- rgarcia 3y ago
  Another method you might consider implementing would be identity verification via SMS code. I've experienced this with docusign: https://support.docusign.com/s/document-item?language=en_US&rsc_301=&bundleId=gav1643676262430&topicId=kzp1578456318101.html&_LANG=enus https://support.docusign.com/s/document-item?language=en_US&... It requires you to know the phone number of the signer, but for important stuff you typically do.
  - somery 3y ago
    Yep, support for SMS verification will be added eventually with ability to bring own Twilio credentials when self-hosting it.
hkhanna 3y ago
One of the tough things about a party-controlled, self-hosted e-signature is that it becomes easier to repudiate because a party to the contract has custody of the platform. The non-custodial party can claim they never signed, and when the custodial party produces evidence of IP address and timestamp, the non-custodial party may have a credible argument that they are faked and the person asserting those authenticated details has the motive and means to fake them. That argument is much harder to assert with something like DocuSign because it is unlikely DocuSign would put their business on the line to fake someone's signature. I'm not saying repudiation based on custody of the e-signature platform is a winning argument, but it's something to consider before self-hosting if you are going to use the platform to sign your own contracts.
- dboreham 3y ago
  If only someone would invent a public nonrepudiatable ledger.
  - ooterness 3y ago
    Like a chain of blocks? Where each block is signed by adding a prefix that produces an increasingly difficult hash?
    - snapplebobapple 3y ago
      someone should combine a chain of blocks for identity management with one for financial transactions/tokens and one for signature attestation. We could call it the cube chain and usher in web 4.0.....
    - cseleborg 3y ago
      Wait... You're talking about Git, right? Brilliant idea! You could sign a pull request, and once it's signed, you can then merge the businesses. But how do you show a diff of the signature? And what if it's not for a corporate merger?
      - 3y ago
stevefan1999 3y ago
Only if we can use our Yubikey to sign the document...
- deleted 3y ago
  [deleted]

somery 3y ago

IP addresses and browser User Agent strings are stored for each signature/submission - those are the only measures for 'non-repudiation' currently available. but i think it doens't differ from other mainstream SaaS solutions - if you read through their terms of services - they put 'non-repudiation' liability on users of their services

dtx1 3y ago
Those are both unfortunatly trivially faked
- infogulch 3y ago
  And yet it's the standard practice for normal people.
  - dtx1 3y ago
    From my research this has 0 legal validity, at least in germany in regards to the EU eIDAS. They are just smoke and mirrors for companies to make them "feel" secure but without cryptographic ensurances (Advanced Electronic Signature) or TLS like Signed Cryptography (Qualified Electronic Signature) this is just as legally binding or not binding as an E-Mail
    - V__ 3y ago
      > just as legally binding or not binding as an E-Mail Which is legally binding. In Germany most contracts are free-form contracts (Formfreiheit) and only need declarations of intent in the form of offer and acceptance. This can be a handshake or even a head shake.
      - infogulch 3y ago
        Or perhaps even an emoji reaction in a text chat, as described elsewhere itt.
    - etothepii 3y ago
      Unless you are a qualified lawyer it would be polite to begin a comment like this with IANAL. IANAL but in the common law world a contract requires 3 things: * Offer and acceptance * Consideration (something of value) * An intention to form legal relations. Acceptance is, of course, what a signature signifies. Acceptance is "a matter of fact" and thus in reality pretty much anything will do.
      - TheNewsIsHere 3y ago
        Yeah, it’s not like in the spirit of the law you can perform your part of the contract and then get away with saying “I never agreed”. In the US, we have a federal law that covers electronic contract signing. I believe it’s part of the UCC? (I’m not an attorney, and that area isn’t one I practice with in tech either.)
- _ea1k 3y ago
  Signatures are pretty easy to fake too, because basically noone verifies them. In practice, the security involved only has to reach the "good enough" threshold and not a 100% hack proof level.
rgarcia 3y ago
Another method you might consider implementing would be identity verification via SMS code. I've experienced this with docusign: https://support.docusign.com/s/document-item?language=en_US&rsc_301=&bundleId=gav1643676262430&topicId=kzp1578456318101.html&_LANG=enus https://support.docusign.com/s/document-item?language=en_US&... It requires you to know the phone number of the signer, but for important stuff you typically do.
- somery 3y ago
  Yep, support for SMS verification will be added eventually with ability to bring own Twilio credentials when self-hosting it.

hkhanna 3y ago

One of the tough things about a party-controlled, self-hosted e-signature is that it becomes easier to repudiate because a party to the contract has custody of the platform. The non-custodial party can claim they never signed, and when the custodial party produces evidence of IP address and timestamp, the non-custodial party may have a credible argument that they are faked and the person asserting those authenticated details has the motive and means to fake them. That argument is much harder to assert with something like DocuSign because it is unlikely DocuSign would put their business on the line to fake someone's signature. I'm not saying repudiation based on custody of the e-signature platform is a winning argument, but it's something to consider before self-hosting if you are going to use the platform to sign your own contracts.

dboreham 3y ago
If only someone would invent a public nonrepudiatable ledger.
- ooterness 3y ago
  Like a chain of blocks? Where each block is signed by adding a prefix that produces an increasingly difficult hash?
  - snapplebobapple 3y ago
    someone should combine a chain of blocks for identity management with one for financial transactions/tokens and one for signature attestation. We could call it the cube chain and usher in web 4.0.....
  - cseleborg 3y ago
    Wait... You're talking about Git, right? Brilliant idea! You could sign a pull request, and once it's signed, you can then merge the businesses. But how do you show a diff of the signature? And what if it's not for a corporate merger?
    - 3y ago

stevefan1999 3y ago

Only if we can use our Yubikey to sign the document...

deleted 3y ago
[deleted]