5 ms·

The way a system like docusign works is that it is a (trusted) independent third party that will verify that the owner of email address X is the one that "signe

The way a system like docusign works is that it is a (trusted) independent third party that will verify that the owner of email address X is the one that "signed" the specific version of an agreement. By self-hosting, you have access to the infrastructure and can manipulate it to your will. There is no proof that the counterparty signed anything - you could just manipulate it to say they did. This potential for misuse could make it difficult to enforce your contract should you be required to do so.

deleted 3y ago
[deleted]
dtx1 3y ago
Not entirely true, cryptographic signatures exist. For example the EU eIDAS Law allows Advanced Cryptographic Signatures to basically just be PGP Signed Emails
- Nextgrid 3y ago
  Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice. Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use. I wish smartcards took off and computers included readers as standard. This would not only solve strong authentication but also payments (just insert your bank card and do EMV-style payments with comparable levels of security).
  - pohuing 3y ago
    The German eID has had that for years now. And it works pretty well. Only problem is that nobody uses it because our processes aren't adapted to it. The first time I used it for anything, apart from signing pgp keys, was to collect 200€ rent assistance and it worked flawlessly in 4 minutes.
    - imdoor 3y ago
      Latvian eID also provides cryptographic signing, and it's widely used when communicating with governmental institutions, because it's mandated by law that they must accept such digitally signed documents, and they have the same legal power as regular documents. I believe the situation in Estonia and Lithuania is probably similar. Many businesses also accept them but it's not universal.
  - Foobar8568 3y ago
    We do use this type of signatures here but for specific use cases, generally with administration like bodies, but not only. Generally speaking, the basic eSign covers 9x% of the needs.
  - lomase 3y ago
    I can sign documents with my goverment ID card, I use my phone NFC as card reader in my computer with an goverment app, it is kind of clunky but it works.
- supermatt 3y ago
  Yeah, we use them here in Lithuania - but I have never seen them used for private contracts. I'm not even sure how i can use my signature outside the AWFUL experience that is the government esig portal. I dont think they are accessible for non-resident entities either - i.e. i can only get lithuanian signatures through the lithuanian portal. This likely explains why they arent used b2b as you would need a separate contract process for foreign and domestic.
_ea1k 3y ago
I do wonder about that for self-hosting a service like this. But how often do actual disputes arise between parties as to whether a document was actually signed or fraudulently altered? TBH, even a contract rests on a certain amount of trust between the involved parties.
- somery 3y ago
  When selfhosting it - it's possible to connect AWS S3 to store the documents - AWS with S3 logs could be used as a source of trust to ensure the documents are not altered.
  - yencabulator 3y ago
    Nothing prevents the person running the software from submitting a "bad document" stating anything they want, with plausible IPs and timestamps etc. That is the problem. A third party like DocuSign is somewhat comparable to using an escrow company to buy a house. You trust the escrow company to not steal the money, but you don't have to trust the seller. You trust DocuSign to not forge document metadata.
- croes 3y ago
  It's not about how often but about if a dispute arises. If in that case the signature can't be trusted why signing in the first place?
awinter-py 3y ago
I mean both parties have an email receipt (but then why not just use email) I think the infrastructure need here is extensible messaging. There are a lot of multiparty flows with notification and recordkeeping requirements

deleted 3y ago

[deleted]

dtx1 3y ago

Not entirely true, cryptographic signatures exist. For example the EU eIDAS Law allows Advanced Cryptographic Signatures to basically just be PGP Signed Emails

Nextgrid 3y ago
Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice. Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use. I wish smartcards took off and computers included readers as standard. This would not only solve strong authentication but also payments (just insert your bank card and do EMV-style payments with comparable levels of security).
- pohuing 3y ago
  The German eID has had that for years now. And it works pretty well. Only problem is that nobody uses it because our processes aren't adapted to it. The first time I used it for anything, apart from signing pgp keys, was to collect 200€ rent assistance and it worked flawlessly in 4 minutes.
  - imdoor 3y ago
    Latvian eID also provides cryptographic signing, and it's widely used when communicating with governmental institutions, because it's mandated by law that they must accept such digitally signed documents, and they have the same legal power as regular documents. I believe the situation in Estonia and Lithuania is probably similar. Many businesses also accept them but it's not universal.
- Foobar8568 3y ago
  We do use this type of signatures here but for specific use cases, generally with administration like bodies, but not only. Generally speaking, the basic eSign covers 9x% of the needs.
- lomase 3y ago
  I can sign documents with my goverment ID card, I use my phone NFC as card reader in my computer with an goverment app, it is kind of clunky but it works.
supermatt 3y ago
Yeah, we use them here in Lithuania - but I have never seen them used for private contracts. I'm not even sure how i can use my signature outside the AWFUL experience that is the government esig portal. I dont think they are accessible for non-resident entities either - i.e. i can only get lithuanian signatures through the lithuanian portal. This likely explains why they arent used b2b as you would need a separate contract process for foreign and domestic.

_ea1k 3y ago

I do wonder about that for self-hosting a service like this. But how often do actual disputes arise between parties as to whether a document was actually signed or fraudulently altered? TBH, even a contract rests on a certain amount of trust between the involved parties.

somery 3y ago
When selfhosting it - it's possible to connect AWS S3 to store the documents - AWS with S3 logs could be used as a source of trust to ensure the documents are not altered.
- yencabulator 3y ago
  Nothing prevents the person running the software from submitting a "bad document" stating anything they want, with plausible IPs and timestamps etc. That is the problem. A third party like DocuSign is somewhat comparable to using an escrow company to buy a house. You trust the escrow company to not steal the money, but you don't have to trust the seller. You trust DocuSign to not forge document metadata.
croes 3y ago
It's not about how often but about if a dispute arises. If in that case the signature can't be trusted why signing in the first place?

awinter-py 3y ago

I mean both parties have an email receipt (but then why not just use email) I think the infrastructure need here is extensible messaging. There are a lot of multiparty flows with notification and recordkeeping requirements