Depending on the use case, OpenTimestamps may be relevant. They also have a long list of member organizations/companies that might provide a more relevant solution for you.
Ask HN: Why isn't there something like Let's Encrypt for document signing?
31–40 of 80 posts
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#32In my company, we are building a new free product, Kentro Sign, which his a document signing based on Corda blockchain. If you want to try it, it's free (not even a free tier) and it's there : https://sign.kentro.network/ . Feel free to give back any feedback. I am a mere DevOps Engineer, but I will forward it !
Sorry you lost me on blockain. Also IF any blockchain were to be used to persist stuff like this it's the biggest, most decentralized.
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#33SMIME certs for email are to my knowledge the most relevant analogy for a “web pki for users”. There is no ACME-over-email for SMIME that has made it out of rfc into practice, so that is the first hurdle. Hurdle #2 is there is only relatively weak agreement (AFAIK) on a “internet trust bundle for SMIME CAs”. Hurdle #3 is likely a lack of modern amenities like CT for SMIME CAs.
That's a great hint, will look into that..
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#34Earlier quoted context omitted.
No free service I know of will let you generate a certificate on the fly with your name on it, which will be considered trusted by most out of the box sw You can get free digital certificates to sign PDFs with your email address, from basically any company. But that is hardly a way to verify your identity. Anyone can create any email address they want, and use any name in the address. The eIDAS directory lists some c…
I saw I was downvoted, with no reply to learn more about where I was wrong. (I don't get this site, where ppl know you're wrong but are unable to post a better idea. Is this about discussing topics to learn more, or shooting ppl down ?) Did I miss something ? Can someone give me some clue ? Digital signatures are an interesting topic.
I also agree with you for what it's worth. Even it is somewhat possible, it should be WAY more open and free. Like SSL it's not a luxury competitve edge, but basic modern day infrastructure
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#35You could probably use Sigstore[1] for this: it's a free, publicly run CA and transparency log that ties signatures to OIDC identities, meaning that verifying a signature doesn't require maintaining a long-term keychain -- you can simply ask whether the input was signed with the same email identity that mailed it.
The project is currently more focused on software signing, but it's generic over any input under the hood. The bigger challenge here would probably be mucking with whatever signature envelope PDFs use, and ensuring that existing PDF verification tooling can consume Sigstore signatures.
FD: I'm involved in the Sigstore project.
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#36Earlier quoted context omitted.
Well you can do it in the EU. You can apply to become a CA for document signing and then give out signed documents. https://www.zealid.com/en/ does it free of charge
Presumably there's a irreducible amount of Extended Validation involved in qualifying as such a CA, though, no? Which would be the GP's point — you can't have a fleet of thousands of machines where each one individually, automatically, and anonymously registers to become its own signing CA.
If the target is legal recognition then you need to store your legally-recognized name and need to do what patio11 calls a hybrid system - part-offline, part-online verification. Also, IIRC there's a free government CA in Estonia that can sign documents, but of course you need to trust that Estonia is both not malicious and not incompetent.
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#37Someone said it already: it's not a technical problem. This is a business problem, which means it's a social/psych thing. >= VP-level generally[1] don't recognize the signed doc as a signed doc. Unless they see that little A arrowhead in the top bar.
W3C and Google aren't helping things here; by drip-feeding PMM into CSS, they've made it impossible to get a consistent HTML5-based print standard. Which could then be wrapped in "normal" auth0. However, I don't know the details of the whole shebang, all I know is that PMM3 was in the works in 2006 and it never quite came out of its hole. Instead you have to shovel out money to Prince or figure out how Paged.js works. But whether or not that's W3C or Google's fault, I really don't know. Maybe HN could edukamate me.
[1] Particularly the older ones that think they're hip. Others just let their tech-savvy assistants sign everything.
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#38Document signing is NOT a technical problem. It's a legal acceptance problem - and everyone KNOWS docusign and friends and understands how they're admissible. Anything else would have to compete with that and people would be suspicious of it for a long time. The best way for something like LE for docusign to start would be via a government office of some sort.
So much this. Adobe Sign (available with the free Adobe Reader) for example offers a self sign solution. Organisations can issue their own certificates and use Adobe Reader’s certificate signing feature if you do not want to use a paid service like Docusign.
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#39Document signing is about verification of authenticity of origin of author. LetEncrypt does not do this, not even for websites. I can get LE certs for millions of end-points I do not own due to the way many cloud providers abuse DNS and sub-domains. Some people do this day and night as a way to make a buck on the side from bug bounties. One of them I will never forget as he adds pictures of cute puppies to corporate…
I had a document notarized and was amazed that the person only did the signature page. I could have easily swapped out the entire contract. I do not understand this. At least a digital signature let's you know what document was signed by a person you have no idea about. What we really need is a human notary that digitally signs a document that is scanned and printed with a QR sort of notarization on each page.
Signatures are also only on the signature page.
This has always struck me as a fatal flaw, and yet in practice it seems to never be a problem.
I don't know what to make of this. The easily-drawn conclusions (power of law, ambient human honesty) from these conflicting ideas feel inadequate.
Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?
#40Document signing is about verification of authenticity of origin of author. LetEncrypt does not do this, not even for websites. I can get LE certs for millions of end-points I do not own due to the way many cloud providers abuse DNS and sub-domains. Some people do this day and night as a way to make a buck on the side from bug bounties. One of them I will never forget as he adds pictures of cute puppies to corporate…
I had a document notarized and was amazed that the person only did the signature page. I could have easily swapped out the entire contract. I do not understand this. At least a digital signature let's you know what document was signed by a person you have no idea about. What we really need is a human notary that digitally signs a document that is scanned and printed with a QR sort of notarization on each page.
the person only did the signature page
I have witnessed that as well. I made them scan the documents again. It doesn't even have to be a major change in a document to change the context entirely. Sometimes just changing and to or, or our to your can drastically change the agreement. That is easy for a busy lawyer to miss.