7 ms·

Someone did this recently to me i.e. showed me something I'd signed which I didn't. Fortunately this lead to their demise as I am friends with their manager whi

by baz00 3y ago

Someone did this recently to me i.e. showed me something I'd signed which I didn't. Fortunately this lead to their demise as I am friends with their manager which was unknown by the party in question. Historically I tend to try something on with employment contracts too - I return an unsigned copy to the company. Only 1 out of 6 companies I worked for didn't just stick it in a filing cabinet and forget about it. Ultimately I learned that a signature is definitely not proof that someone explicitly signed anything or what the state was at the point of signing it. It must be the full document plaintext and date signed with your private key and should be verifiable with your public key by a court before a claim is even approachable. Docusign sort of does a half-assed version of this but there needs to be a full legal PKI system on this planet and people need to understand it too. That's the most difficult problem to solve.

jacquesm 3y ago
Someone forged my signature on docusign on a pretty official document and I raked them over the coals for it. Highly annoying these services, they don't do even the most basic verification that the person signing really is the person that should be signing.
- baz00 3y ago
  Yes this is the point about docusign being half assed. It doesn't do any identity validation really. It should verify the signer and the signee are the parties in question using identity services. It doesn't. I believe it can but it doesn't usually get used.
  - bombcar 3y ago
    A signed document that isn't notarized is just a formality, in my opinion. If you care enough to get it really signed, pay the notary.
    - ghaff 3y ago
      Most people's signature these days isn't much more an attestation than putting on an X on the line or checking a box that "I agree." Docusign just makes the process a bit more formal. To the degree that signing a lot of documents is something of a formality, most of us don't want to have to go to a notary every time we need to put our signature on something.
  - mindslight 3y ago
    So then every Docusign use would demand that you help the surveillance companies verify the files they have on you, where you used to live, etc? And then they would use this shoddy "verification" as evidence that the person who clicked accepted was really you? No thanks! What actually needs to happen is that things like Docusign need to be contextualized and treated as the appropriate amount of evidence of a contract that they are. Which is to say not much, just like a piece of paper with a signature on it these days. A "signed" Docusign is evidence that someone opened an email link and clicked a box from a certain IP. It does not prove that a specific person did this. It does not prove that the person who did this actually read, understood, and agreed with the words in the document. In fact, a Docusign that didn't allow marking up the document is itself evidence that the person in question was coerced into accepting unilateral boilerplate terms, rather than being able to make modifications. Like many legacy systems in the US, the jankiness from using an antiquated system is actually preventing a much more draconian system that would develop if the abstraction was made solid (for a straightforward example, see "identity theft").
- Mandatum 3y ago
  They do. You just won’t pay for it. When you sign a mortgage or take out a loan and it’s all online, lenders will pay someone to come to your house, take a photo of you, verify it, and then video tape you signing. It’s just not convenient.
  - jacquesm 3y ago
    I won't pay for it because I don't want to use Docusign.
    - dmix 3y ago
      Any reason? What about emailed only PDFsS Email is a minor identity validation.
      - jacquesm 3y ago
        Because it's a broken model that is just one small step away from a complete disaster. Think about the value of inserting yourself in the signing process of a whole slew of official documents. Just the ability to fake it with authentic looking signatures is a real problem. See TFA...
  - ghaff 3y ago
    I had to do a one-off brokerage (where I don't have a personal representative) transfer fairly recently and, although they loosened up a bit during COVID, they were back to basically requiring me to show up at a brokerage branch in person. In theory, I could have gotten a Medallion Signature from my bank but it turned out they couldn't do it at my local branch and getting their central system to do it failed, so I just drove the 40 minutes or so to a brokerage branch. This is the problem with things like account recovery. If you really want to minimize social engineering etc., you'll do something requiring a physical presence and various sorts of government issued ID and will probably cost money. And people won't like that. (And the companies won't like it because there's a lot of overhead.)
    - MichaelZuo 3y ago
- ghaff 3y ago
  I'm pretty sure just about anytime I've had a Docusign link, it's been from someone I already had a relationship with and it's been the pro-forma equivalent of printing out a document, signing it (scribbling a couple lines)/initialing it, scanning it, and sending it back. (ADDED: Except that unencrypted PDFs aren't being emailed around.) In neither case is there any real additional identity verification.
bdjeudug 3y ago
You’re intentionally returning unsigned contacts to employers hoping they don’t notice? Seeing how you’re first action in each of your new jobs is done in bad faith I think I see why you’ve had to fill out six of them…
- dmix 3y ago
  You could easily get by by saying it was just a mix up and you emailed the wrong PDF. Not saying it's ethical though. I'm also not really sure which situations an employment contract would really hurt you in tech besides maybe some IP stuff. NDAs are usually separate.
  - constantly 3y ago
    Not that I necessarily agree with the person you’re responding to, but their point seems to be that this is a bad faith action, not that they will get in trouble for it and need to cover it up with further bad faith.
  - caminante 3y ago
    I inherit non-countersigned contracts frequently. IANAL,but they're still enforceable, especially in the grandparent's situation where the grandparent's work product was accepted and they were paid. There are realms of contract law where signature compliance is more prescribed like probate.
  - thayne 3y ago
    > I'm also not really sure which situations an employment contract would really hurt you in tech besides maybe some IP stuff In my first contract for a dev job: - noncompete - agreement to work for a minimum amount of time, while my employer could terminate me at will (I don't think this one was actually enforceable where I live, since I didn't get a signing bonus, but I didn't know that at the time) - IP stuff - agreement to arbitration for any disputes (and employer chooses the arbitrator of course) I would probably dispute some of those now, but as at the time I was naive, fresh out of college. And even if I had pushed back, I didn't have much leverage. I had just moved, and had no money, I couldn't afford not to take the job.
petesergeant 3y ago
> I tend to try something on with employment contracts too - I return an unsigned copy to the company. So you email it back without comment, which shows you received it and understood what it was, and then started work… I suspect that’s binding in many jurisdictions, and the lack of an actual signature is simply an inconvenience
- londons_explore 3y ago
  Indeed - as soon as you start work, and get paid, then an employment agreement exists between you. If they emailed you terms beforehand and you still started work, then most courts would take that to indicate your acceptance of the terms.
- jawns 3y ago
  What if they crossed out a few clauses and signed, and the employer never noticed. Are you saying that because they begin working for the company, that represents the company's tacit acceptance of the modifications to the contract?
  - mistrial9 3y ago
    years ago I made a habit of making small changes to contracting agreements. The net results off the top of my head? most contracts sent were written for one side, not both sides, making some changes to defend my side simple self-defense (I didn't change the compensation terms); I only got the changes accepted two out of three times or so; when the tides of tech changed, I was the first to be left out.. it seems in hindsight that this was some kind of "larval state" for me.. I had to either get more authority in writing to become stable, or, be replaced by compliant, more desperate, more outsourced "talent" that could do specific tech work. As an intellectual, I went back to school, and lost the chance to embed and define authority in contractual relationships at the same time.
  - petesergeant 3y ago
    I think you have a significantly bigger burden of proof to prove the other party had accepted it if you signed it and returned it having amended it without mentioning those changes in the email, and it would be much less clear cut. If you mentioned “here it is with a few small changes”, and you got back an email that said “received”, even if they didn’t explicitly ok the changes or sign it, and you started working, I think you’d be on much firmer ground though. There’ll be explicit case law but it’ll come down to “would a reasonable person think the changes to the contract had been accepted”
casmike 3y ago
Some countries have electronic signatures linked to biometric IDs. Various devices can then be used to verify the signer's natural identity when signing documents online, like a mobile phone (both smart and dumb). I lived in a country like this and all my electronic signatures were linked to my natural person. Most documents were signed this way - from rental agreements to tax returns. It was very uncanny to start using things like Adobe Sign or DocuSign afterwards which is very popular in the UK and US. For the curious - look up m-signature and e-signature in Lithuania.
- Jnr 3y ago
  Whole EU and EEZ has standard approved verified electornic signature format. So in EU even cross country signing is possible.
  - Roark66 3y ago
    Indeed, it is a pretty cool system, but every time I look into it I'm puzzled by the variety of costs for essentially the same thing. You can buy a cheapest personal certificate that is recognised as equivalent to a physical signature for contract signing for 50eur for 1 year. Or you can spend 500EUR for the same thing. Some come with a smart card, some don't. For some you get software that works offline, for some you can use open source signing software, for others you get nothing and you need to sign the documents via "their website". Some boast "notary approved" which means nothing. For things that require a notary like real estate transactions you still need a notary. My bank even sells "single use" certificates, good for 15 minutes for 5eur. It's a nice convenience, but some of the costs are insane.
    - Jnr 3y ago
      At least in Latvia use of qualified electronic signature is completely free of charge. And you can use government provided service or a 3rd party one backed by banks. It used to cost something for each signature since they have to run the time signature server but they quickly reallised that it made no sense to charge for it.
    - 3y ago
ClumsyPilot 3y ago
> It must be the full document plaintext and date signed with your private key and should be verifiable with your public key by a court before a claim is even approachable. This is called a notary public. Its a routine requirement with immigration documents. .They can also certify copies as true. In UK for sone reason it costs over £100, and noone uses them, but in eastern europe its common and notarising documents is like €5 - they just check you identity
- dzhiurgis 3y ago
  In New Zealand we've got Justices of Peace (JP's) - it's just some retired lawyers that can notarise your documents. You typically go to their home or they have little popups in public places. Best part - it's free!
  - mikrotikker 3y ago
    I don't think it's just retired lawyers. My uncle is a JP and hes a ferry captain. But he did have to so some kind of ceremony at the courts. I think he did it in order to be the family marriage celebrant and whatnot. Some JPs take payment in the form of a box of beer or some small thing like that.
- cafard 3y ago
  I believe that the states regulate notaries in the US. One in my neighborhood charges $5/document.
- ghaff 3y ago
  In the US, you usually just go into your bank branch. I'm not sure what the deal is if you don't have a local financial institution/lawyer/etc. (Exec admins are sometimes also notaries.)
  - gumby 3y ago
    Or call a mobile notary who will come to you.
  - deleted 3y ago
Obscurity4340 3y ago
Sorry, what happened with your friend? They forged a digital signature for you and threw it in your face later or something? What was the context for all this?
- baz00 3y ago
  They were asked to prepare a report about a safety incident at an event I went to. They provided a statement to their manager which was more than a bit economical with the truth and copied my signature off a contract signing that the statement was accurate. I ahd neither seen, agreed to or signed the statement.
taneq 3y ago
> Ultimately I learned that a signature is definitely not proof that someone explicitly signed anything or what the state was at the point of signing it. I've wondered about this from the first moment I scanned a copy of my signature to feed in to Acrobat for signing PDFs. There seems to still be an unreasonable amount of trust in the idea that a squiggle on paper is difficult for other people to reproduce. But then, it's never been about preventing forgery, because forgery has always been relatively simple. Signatures are just a ritual performed between honest people to help them remember that they're honest.
wincy 3y ago
I don’t think that’s an appropriate use of the word demise unless your manager friend killed the person in question. Which scummy move, for sure but I hope it didn’t actually lead to their demise.
- derekja 3y ago
  Colloquially I think you may be right, but the dictionary definition makes it appropriate here: Demise Definition & Meaning noun ; a · death ; b · a cessation of existence or activity ; c · a loss of position or status.
Majromax 3y ago
> Historically I tend to try something on with employment contracts too - I return an unsigned copy to the company That doesn't necessarily mean that you don't have a contract. Barring specific law regulating the form (such as often happens for property exchanges), the contract is sealed with acceptance. An act of acceptance can be overt such as via signature, but it can also be implied. By returning the contract as if signed, performing the work specified under the contract, and receiving pay, both you and the employer are acting as if you both have accepted the contract. If a court was asked to adjudicate a dispute (such as over a termination issue like severance pay), a judge could reasonably hold you and the company bound to the terms. > It must be the full document plaintext and date signed with your private key and should be verifiable with your public key by a court before a claim is even approachable. Why? Most contract disputes don't turn on whether the text of the contract is authentic. That's resolved by a full PKI-based signature, but such a signature can't decide whether the interpretation of the terms is correct, or whether the contract has been performed, or whether the contract was signed under duress (perhaps making acceptance invalid), or whether the contract is conscionable and consistent with public policy.
- flir 3y ago
  Was going to say the same thing - doing the work is implicit acceptance of the contract, signature be damned. Verbal contracts are legally binding, after all (although hard to prove). (IANAL).
  - edmundsauto 3y ago
    I suppose it would allow one to question specific clauses, suggesting those are not part of the contract. That would of course be fraud.
JimtheCoder 3y ago
"Fortunately this lead to their demise" I hope you mean they just lost their job or something...

by baz00 3y ago

jacquesm 3y ago

Someone forged my signature on docusign on a pretty official document and I raked them over the coals for it. Highly annoying these services, they don't do even the most basic verification that the person signing really is the person that should be signing.

baz00 3y ago
Yes this is the point about docusign being half assed. It doesn't do any identity validation really. It should verify the signer and the signee are the parties in question using identity services. It doesn't. I believe it can but it doesn't usually get used.
- bombcar 3y ago
  A signed document that isn't notarized is just a formality, in my opinion. If you care enough to get it really signed, pay the notary.
  - ghaff 3y ago
    Most people's signature these days isn't much more an attestation than putting on an X on the line or checking a box that "I agree." Docusign just makes the process a bit more formal. To the degree that signing a lot of documents is something of a formality, most of us don't want to have to go to a notary every time we need to put our signature on something.
- mindslight 3y ago
  So then every Docusign use would demand that you help the surveillance companies verify the files they have on you, where you used to live, etc? And then they would use this shoddy "verification" as evidence that the person who clicked accepted was really you? No thanks! What actually needs to happen is that things like Docusign need to be contextualized and treated as the appropriate amount of evidence of a contract that they are. Which is to say not much, just like a piece of paper with a signature on it these days. A "signed" Docusign is evidence that someone opened an email link and clicked a box from a certain IP. It does not prove that a specific person did this. It does not prove that the person who did this actually read, understood, and agreed with the words in the document. In fact, a Docusign that didn't allow marking up the document is itself evidence that the person in question was coerced into accepting unilateral boilerplate terms, rather than being able to make modifications. Like many legacy systems in the US, the jankiness from using an antiquated system is actually preventing a much more draconian system that would develop if the abstraction was made solid (for a straightforward example, see "identity theft").
Mandatum 3y ago
They do. You just won’t pay for it. When you sign a mortgage or take out a loan and it’s all online, lenders will pay someone to come to your house, take a photo of you, verify it, and then video tape you signing. It’s just not convenient.
- jacquesm 3y ago
  I won't pay for it because I don't want to use Docusign.
  - dmix 3y ago
    Any reason? What about emailed only PDFsS Email is a minor identity validation.
    - jacquesm 3y ago
      Because it's a broken model that is just one small step away from a complete disaster. Think about the value of inserting yourself in the signing process of a whole slew of official documents. Just the ability to fake it with authentic looking signatures is a real problem. See TFA...
- ghaff 3y ago
  I had to do a one-off brokerage (where I don't have a personal representative) transfer fairly recently and, although they loosened up a bit during COVID, they were back to basically requiring me to show up at a brokerage branch in person. In theory, I could have gotten a Medallion Signature from my bank but it turned out they couldn't do it at my local branch and getting their central system to do it failed, so I just drove the 40 minutes or so to a brokerage branch. This is the problem with things like account recovery. If you really want to minimize social engineering etc., you'll do something requiring a physical presence and various sorts of government issued ID and will probably cost money. And people won't like that. (And the companies won't like it because there's a lot of overhead.)
  - MichaelZuo 3y ago
ghaff 3y ago
I'm pretty sure just about anytime I've had a Docusign link, it's been from someone I already had a relationship with and it's been the pro-forma equivalent of printing out a document, signing it (scribbling a couple lines)/initialing it, scanning it, and sending it back. (ADDED: Except that unencrypted PDFs aren't being emailed around.) In neither case is there any real additional identity verification.

bdjeudug 3y ago

You’re intentionally returning unsigned contacts to employers hoping they don’t notice? Seeing how you’re first action in each of your new jobs is done in bad faith I think I see why you’ve had to fill out six of them…

dmix 3y ago
You could easily get by by saying it was just a mix up and you emailed the wrong PDF. Not saying it's ethical though. I'm also not really sure which situations an employment contract would really hurt you in tech besides maybe some IP stuff. NDAs are usually separate.
- constantly 3y ago
  Not that I necessarily agree with the person you’re responding to, but their point seems to be that this is a bad faith action, not that they will get in trouble for it and need to cover it up with further bad faith.
- caminante 3y ago
  I inherit non-countersigned contracts frequently. IANAL,but they're still enforceable, especially in the grandparent's situation where the grandparent's work product was accepted and they were paid. There are realms of contract law where signature compliance is more prescribed like probate.
- thayne 3y ago
  > I'm also not really sure which situations an employment contract would really hurt you in tech besides maybe some IP stuff In my first contract for a dev job: - noncompete - agreement to work for a minimum amount of time, while my employer could terminate me at will (I don't think this one was actually enforceable where I live, since I didn't get a signing bonus, but I didn't know that at the time) - IP stuff - agreement to arbitration for any disputes (and employer chooses the arbitrator of course) I would probably dispute some of those now, but as at the time I was naive, fresh out of college. And even if I had pushed back, I didn't have much leverage. I had just moved, and had no money, I couldn't afford not to take the job.

petesergeant 3y ago

> I tend to try something on with employment contracts too - I return an unsigned copy to the company. So you email it back without comment, which shows you received it and understood what it was, and then started work… I suspect that’s binding in many jurisdictions, and the lack of an actual signature is simply an inconvenience

londons_explore 3y ago
Indeed - as soon as you start work, and get paid, then an employment agreement exists between you. If they emailed you terms beforehand and you still started work, then most courts would take that to indicate your acceptance of the terms.
jawns 3y ago
What if they crossed out a few clauses and signed, and the employer never noticed. Are you saying that because they begin working for the company, that represents the company's tacit acceptance of the modifications to the contract?
- mistrial9 3y ago
  years ago I made a habit of making small changes to contracting agreements. The net results off the top of my head? most contracts sent were written for one side, not both sides, making some changes to defend my side simple self-defense (I didn't change the compensation terms); I only got the changes accepted two out of three times or so; when the tides of tech changed, I was the first to be left out.. it seems in hindsight that this was some kind of "larval state" for me.. I had to either get more authority in writing to become stable, or, be replaced by compliant, more desperate, more outsourced "talent" that could do specific tech work. As an intellectual, I went back to school, and lost the chance to embed and define authority in contractual relationships at the same time.
- petesergeant 3y ago
  I think you have a significantly bigger burden of proof to prove the other party had accepted it if you signed it and returned it having amended it without mentioning those changes in the email, and it would be much less clear cut. If you mentioned “here it is with a few small changes”, and you got back an email that said “received”, even if they didn’t explicitly ok the changes or sign it, and you started working, I think you’d be on much firmer ground though. There’ll be explicit case law but it’ll come down to “would a reasonable person think the changes to the contract had been accepted”

casmike 3y ago

Some countries have electronic signatures linked to biometric IDs. Various devices can then be used to verify the signer's natural identity when signing documents online, like a mobile phone (both smart and dumb). I lived in a country like this and all my electronic signatures were linked to my natural person. Most documents were signed this way - from rental agreements to tax returns. It was very uncanny to start using things like Adobe Sign or DocuSign afterwards which is very popular in the UK and US. For the curious - look up m-signature and e-signature in Lithuania.

Jnr 3y ago
Whole EU and EEZ has standard approved verified electornic signature format. So in EU even cross country signing is possible.
- Roark66 3y ago
  Indeed, it is a pretty cool system, but every time I look into it I'm puzzled by the variety of costs for essentially the same thing. You can buy a cheapest personal certificate that is recognised as equivalent to a physical signature for contract signing for 50eur for 1 year. Or you can spend 500EUR for the same thing. Some come with a smart card, some don't. For some you get software that works offline, for some you can use open source signing software, for others you get nothing and you need to sign the documents via "their website". Some boast "notary approved" which means nothing. For things that require a notary like real estate transactions you still need a notary. My bank even sells "single use" certificates, good for 15 minutes for 5eur. It's a nice convenience, but some of the costs are insane.
  - Jnr 3y ago
    At least in Latvia use of qualified electronic signature is completely free of charge. And you can use government provided service or a 3rd party one backed by banks. It used to cost something for each signature since they have to run the time signature server but they quickly reallised that it made no sense to charge for it.
  - 3y ago

ClumsyPilot 3y ago

> It must be the full document plaintext and date signed with your private key and should be verifiable with your public key by a court before a claim is even approachable. This is called a notary public. Its a routine requirement with immigration documents. .They can also certify copies as true. In UK for sone reason it costs over £100, and noone uses them, but in eastern europe its common and notarising documents is like €5 - they just check you identity

dzhiurgis 3y ago
In New Zealand we've got Justices of Peace (JP's) - it's just some retired lawyers that can notarise your documents. You typically go to their home or they have little popups in public places. Best part - it's free!
- mikrotikker 3y ago
  I don't think it's just retired lawyers. My uncle is a JP and hes a ferry captain. But he did have to so some kind of ceremony at the courts. I think he did it in order to be the family marriage celebrant and whatnot. Some JPs take payment in the form of a box of beer or some small thing like that.
cafard 3y ago
I believe that the states regulate notaries in the US. One in my neighborhood charges $5/document.
ghaff 3y ago
In the US, you usually just go into your bank branch. I'm not sure what the deal is if you don't have a local financial institution/lawyer/etc. (Exec admins are sometimes also notaries.)
- gumby 3y ago
  Or call a mobile notary who will come to you.
- deleted 3y ago

Obscurity4340 3y ago

Sorry, what happened with your friend? They forged a digital signature for you and threw it in your face later or something? What was the context for all this?

baz00 3y ago
They were asked to prepare a report about a safety incident at an event I went to. They provided a statement to their manager which was more than a bit economical with the truth and copied my signature off a contract signing that the statement was accurate. I ahd neither seen, agreed to or signed the statement.

taneq 3y ago

> Ultimately I learned that a signature is definitely not proof that someone explicitly signed anything or what the state was at the point of signing it. I've wondered about this from the first moment I scanned a copy of my signature to feed in to Acrobat for signing PDFs. There seems to still be an unreasonable amount of trust in the idea that a squiggle on paper is difficult for other people to reproduce. But then, it's never been about preventing forgery, because forgery has always been relatively simple. Signatures are just a ritual performed between honest people to help them remember that they're honest.

wincy 3y ago

I don’t think that’s an appropriate use of the word demise unless your manager friend killed the person in question. Which scummy move, for sure but I hope it didn’t actually lead to their demise.

derekja 3y ago
Colloquially I think you may be right, but the dictionary definition makes it appropriate here: Demise Definition & Meaning noun ; a · death ; b · a cessation of existence or activity ; c · a loss of position or status.

Majromax 3y ago

> Historically I tend to try something on with employment contracts too - I return an unsigned copy to the company That doesn't necessarily mean that you don't have a contract. Barring specific law regulating the form (such as often happens for property exchanges), the contract is sealed with acceptance. An act of acceptance can be overt such as via signature, but it can also be implied. By returning the contract as if signed, performing the work specified under the contract, and receiving pay, both you and the employer are acting as if you both have accepted the contract. If a court was asked to adjudicate a dispute (such as over a termination issue like severance pay), a judge could reasonably hold you and the company bound to the terms. > It must be the full document plaintext and date signed with your private key and should be verifiable with your public key by a court before a claim is even approachable. Why? Most contract disputes don't turn on whether the text of the contract is authentic. That's resolved by a full PKI-based signature, but such a signature can't decide whether the interpretation of the terms is correct, or whether the contract has been performed, or whether the contract was signed under duress (perhaps making acceptance invalid), or whether the contract is conscionable and consistent with public policy.

flir 3y ago
Was going to say the same thing - doing the work is implicit acceptance of the contract, signature be damned. Verbal contracts are legally binding, after all (although hard to prove). (IANAL).
- edmundsauto 3y ago
  I suppose it would allow one to question specific clauses, suggesting those are not part of the contract. That would of course be fraud.

JimtheCoder 3y ago

"Fortunately this lead to their demise" I hope you mean they just lost their job or something...