Live data from Hacker News

Ask HN: Why isn't there something like Let's Encrypt for document signing?

news.ycombinator.com

41–50 of 80 posts

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#41
post #9

In my company, we are building a new free product, Kentro Sign, which his a document signing based on Corda blockchain. If you want to try it, it's free (not even a free tier) and it's there : https://sign.kentro.network/ . Feel free to give back any feedback. I am a mere DevOps Engineer, but I will forward it !

why do we need blockchain here again

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#42

Earlier quoted context omitted.

I saw I was downvoted, with no reply to learn more about where I was wrong. (I don't get this site, where ppl know you're wrong but are unable to post a better idea. Is this about discussing topics to learn more, or shooting ppl down ?) Did I miss something ? Can someone give me some clue ? Digital signatures are an interesting topic.

I also agree with you for what it's worth. Even it is somewhat possible, it should be WAY more open and free. Like SSL it's not a luxury competitve edge, but basic modern day infrastructure

there are some initiatives for that, like CACert, a non-profit certificate authority. and ofc, there was GPG

But they're not convenient for businesses : either they buy certificates for their employees, or they have them signed by the IT department, that provisions their key into any piece of corporate equipment.

Few companies are into the community initiatives, especially when it comes to security.

Also, CACert is not widely recognized. The root certificate is only included in a handful of Linux distros (like Arch or Mandriva, but not Debian)

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#43
post #22

Document signing is NOT a technical problem. It's a legal acceptance problem - and everyone KNOWS docusign and friends and understands how they're admissible. Anything else would have to compete with that and people would be suspicious of it for a long time. The best way for something like LE for docusign to start would be via a government office of some sort.

Essentially all validation/verification is some tradeoff between:

1. convenience

2. certainty that someone is who you think they are and they meant to give their approval

3. a "paper" trail

4. And the consequences if you make the wrong call on 2.

For many, but not all purposes, Docusign (plus SMS in many cases to get a code) replaces a lot of fairly routine paper shuffling. It also depends on what a given, often financial, organization has deemed acceptable risk.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#44
post #22

Document signing is NOT a technical problem. It's a legal acceptance problem - and everyone KNOWS docusign and friends and understands how they're admissible. Anything else would have to compete with that and people would be suspicious of it for a long time. The best way for something like LE for docusign to start would be via a government office of some sort.

> It's a legal acceptance problem

We may be saying the same thing, but just to clarify / put another way: it's a legal compliance problem. DocuSign is admissible (in the US) because it adheres to the state and Federal regulations that have been passed which carefully enumerate the requirements of legally acceptable digitally signed documents, for example: https://en.wikipedia.org/wiki/Electronic_Signatures_in_Globa...

It's lower risk in a corporation with a lot to lose to say, here's this implementation that we know is compliant, than to say, we made our own or used an obscure one and we think it is. Corporate politics will usually encourage decision makers to go with the former.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#45
post #39
post #30

Earlier quoted context omitted.

I had a document notarized and was amazed that the person only did the signature page. I could have easily swapped out the entire contract. I do not understand this. At least a digital signature let's you know what document was signed by a person you have no idea about. What we really need is a human notary that digitally signs a document that is scanned and printed with a QR sort of notarization on each page.

Signatures are also only on the signature page. This has always struck me as a fatal flaw, and yet in practice it seems to never be a problem. I don't know what to make of this. The easily-drawn conclusions (power of law, ambient human honesty) from these conflicting ideas feel inadequate.

Basically anything is a compromise.

Notaries are essentially a (relatively) low-friction compromise between just trusting that the person who put some squiggles on a piece of paper is who you think they are and that person traveling to a lawyer's office (or a brokerage etc.) that may be in another state.

Same way you can hopefully get a locked computer account restored without traveling to a Google office in Mountain View between 1 and 2pm on a Thursday to make your case with multiple forms of ID.

The rigor depends on the transaction but usually it's chosen to be a reasonable compromise.

To the specific example of a contract etc., presumably the lawyer has a copy of the original document and that's probably considered canonical in the case of a dispute. There can be edge cases obviously but there are edge cases with everything.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#46
post #9

In my company, we are building a new free product, Kentro Sign, which his a document signing based on Corda blockchain. If you want to try it, it's free (not even a free tier) and it's there : https://sign.kentro.network/ . Feel free to give back any feedback. I am a mere DevOps Engineer, but I will forward it !

What does "company title" mean? There is no delete account option.

What do you mean by "Company title" sorry ?

Thanks for the feedback regarding the delete account option, I will transmit it.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#47
post #9

In my company, we are building a new free product, Kentro Sign, which his a document signing based on Corda blockchain. If you want to try it, it's free (not even a free tier) and it's there : https://sign.kentro.network/ . Feel free to give back any feedback. I am a mere DevOps Engineer, but I will forward it !

why do we need blockchain here again

Corda is a special blockchain where you can control with which nodes you want to share your info. In this way, you can host your own nodes, with your own documents, and share the document only with your peers, instead of sending them away in a more centralized solution like Docusign.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#48
post #22

Document signing is NOT a technical problem. It's a legal acceptance problem - and everyone KNOWS docusign and friends and understands how they're admissible. Anything else would have to compete with that and people would be suspicious of it for a long time. The best way for something like LE for docusign to start would be via a government office of some sort.

> It's a legal acceptance problem We may be saying the same thing, but just to clarify / put another way: it's a legal compliance problem. DocuSign is admissible (in the US) because it adheres to the state and Federal regulations that have been passed which carefully enumerate the requirements of legally acceptable digitally signed documents, for example: https://en.wikipedia.org/wiki/Electronic_Signatures_in_Globa..…

I believe that Docusign helped to draft parts of that legislation. They are a deeply entrenched player that has made regulatory capture part of their strategy. Disrupting them will be hard to impossible for that reason alone.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#49
post #9

In my company, we are building a new free product, Kentro Sign, which his a document signing based on Corda blockchain. If you want to try it, it's free (not even a free tier) and it's there : https://sign.kentro.network/ . Feel free to give back any feedback. I am a mere DevOps Engineer, but I will forward it !

Sorry you lost me on blockain. Also IF any blockchain were to be used to persist stuff like this it's the biggest, most decentralized.

Corda is a special blockchain,it's based on need-to-know basis system. It means you can host your own node, and share your data only to the peers you want.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#50

Earlier quoted context omitted.

> It's a legal acceptance problem We may be saying the same thing, but just to clarify / put another way: it's a legal compliance problem. DocuSign is admissible (in the US) because it adheres to the state and Federal regulations that have been passed which carefully enumerate the requirements of legally acceptable digitally signed documents, for example: https://en.wikipedia.org/wiki/Electronic_Signatures_in_Globa..…

I believe that Docusign helped to draft parts of that legislation. They are a deeply entrenched player that has made regulatory capture part of their strategy. Disrupting them will be hard to impossible for that reason alone.

I have a lot of experience implementing software for a heavily regulated industry. The first challenge is, because of the legal architecture -- go study and diff the legal code for each of the 50 states to implement a tool like this, also, track all the updates to those laws.

I wouldn't be surprised by DocuSign's involvement as you describe, we have the same corruption in every industry, justified always by the same excuse "They're the experts! Who else would we (congress) ask?" I don't believe the ignorance of the massive conflict of interest in this approach is a coincidence but I digress.

Post reply on HN