Live data from Hacker News

Ask HN: Why isn't there something like Let's Encrypt for document signing?

news.ycombinator.com

51–60 of 80 posts

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#51
You can just send a signed pdf over email. Perfectly legal.

Macs even have a terrific signature attachment feature in Preview (the default pdf viewer).

Docusign etc. just add version tracking and document management, but you can just back up email. Even at some scale. Docusign is like buying a picture frame for a document like a diploma, it looks a more official but doesn't change anything.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#52
Could you abuse LetsEncrypt as a content signing service? Take the information you want signed, including a timestamp for good measure, and of course some form of your identity, generate a secure enough hash for it, use that as a sub-domain and get a certificate for it via LE?

So my document plus meta-data like my legal name & email address hashes to b8e24cce6743bf2d86195d1781b068b6fdf1e12a413eb61c16e32e1e5f64f5cc, I get a certificate for b8e24cce6743bf2d86195d1781b068b6fdf1e12a.413eb61c16e32e1e5f64f5cc.sha3-256.docs.mydomain.tld from LE (extra “.” due to the 63 characters per name part limit in DNS specs). By handing over the certificate LE has effectively signed to say that hash was presented to it at that time.

The fact the certificate expires in three months is not relevant: that hash was signed at that time, so it must have been generated then or before then, and it is mathematically impossible (assuming a good hashing algorithm was picked) that when challenged at a later date that I managed to manufacture content that hashes to that value and looks like what I'm claiming to be legitimate & extant at the relevant time, and it is similarly implausible that I forged a certificate that looks like it was signed using one of LE's signing certificates.

Of course the next challenge is convincing people that the certificate means this, and that fact is legally meaningful (assuming, for instance, the “signature certificate” is being verified to prove you created the content before someone who claims something more recent of theirs is prior art).

You also need to stay within LE's limits, so if using only one domain that is at most 50 signed documents per week if you do each individually. You could batch the documents to be signed up in a single set and hash that instead of individual documents, so if you are happy with daily granularity that is only 7/week. If sticking to a regular interval with nice round numbers you can get approx 4-hour granularity (4 signing timeslots per day, so 42 per week, leaving you 8 in case there are circumstances where something time sensitive wants signing right this instant).

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#53
post #51

You can just send a signed pdf over email. Perfectly legal. Macs even have a terrific signature attachment feature in Preview (the default pdf viewer). Docusign etc. just add version tracking and document management, but you can just back up email. Even at some scale. Docusign is like buying a picture frame for a document like a diploma, it looks a more official but doesn't change anything.

It's also perfectly legal to just reply to an email "Looks good to me." That doesn't mean it's legally compliant for all use cases. Perfectly fine for others of course. Just print out and file the emails or save them in a folder.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#54

Earlier quoted context omitted.

I believe that Docusign helped to draft parts of that legislation. They are a deeply entrenched player that has made regulatory capture part of their strategy. Disrupting them will be hard to impossible for that reason alone.

I have a lot of experience implementing software for a heavily regulated industry. The first challenge is, because of the legal architecture -- go study and diff the legal code for each of the 50 states to implement a tool like this, also, track all the updates to those laws. I wouldn't be surprised by DocuSign's involvement as you describe, we have the same corruption in every industry, justified always by the same…

Also remember that the way DocuSign works it is the company paying for it, not the people signing. That makes it even harder to disrupt, because the "great majority of users" are used to the DocuSign workflow and aren't paying and have no incentive to change.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#55
post #30

Earlier quoted context omitted.

I had a document notarized and was amazed that the person only did the signature page. I could have easily swapped out the entire contract. I do not understand this. At least a digital signature let's you know what document was signed by a person you have no idea about. What we really need is a human notary that digitally signs a document that is scanned and printed with a QR sort of notarization on each page.

the person only did the signature page I have witnessed that as well. I made them scan the documents again. It doesn't even have to be a major change in a document to change the context entirely. Sometimes just changing and to or , or our to your can drastically change the agreement. That is easy for a busy lawyer to miss.

All a notary is doing is validating that the person signing a document has a government-issued photo ID that matches the name under a signature line. Nothing more than that.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#56
post #54

Earlier quoted context omitted.

I have a lot of experience implementing software for a heavily regulated industry. The first challenge is, because of the legal architecture -- go study and diff the legal code for each of the 50 states to implement a tool like this, also, track all the updates to those laws. I wouldn't be surprised by DocuSign's involvement as you describe, we have the same corruption in every industry, justified always by the same…

Also remember that the way DocuSign works it is the company paying for it, not the people signing. That makes it even harder to disrupt, because the "great majority of users" are used to the DocuSign workflow and aren't paying and have no incentive to change.

And while I'm sure DocuSign is a very profitable product line, I also suspect that for many companies that use it (like financial firms) its cost is somewhere around their paper clip budget.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#57
post #56
post #54

Earlier quoted context omitted.

Also remember that the way DocuSign works it is the company paying for it, not the people signing. That makes it even harder to disrupt, because the "great majority of users" are used to the DocuSign workflow and aren't paying and have no incentive to change.

And while I'm sure DocuSign is a very profitable product line, I also suspect that for many companies that use it (like financial firms) its cost is somewhere around their paper clip budget.

Yep. My first few mortgages involved getting all the right people in a room together at the same time and signing hundreds of documents, the last two were some websites and clicking.

The amount of time not lost having people watch me perform magic with the pen must have saved way more than DocuSign cost.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#59
post #53
post #51

You can just send a signed pdf over email. Perfectly legal. Macs even have a terrific signature attachment feature in Preview (the default pdf viewer). Docusign etc. just add version tracking and document management, but you can just back up email. Even at some scale. Docusign is like buying a picture frame for a document like a diploma, it looks a more official but doesn't change anything.

It's also perfectly legal to just reply to an email "Looks good to me." That doesn't mean it's legally compliant for all use cases. Perfectly fine for others of course. Just print out and file the emails or save them in a folder.

Well. I guess it depends. An X is a perfectly legal signature, or a smiley face.

As long as all parties agree that it’s a signature.

Re: Ask HN: Why isn't there something like Let's Encrypt for document signing?

#60
post #57
post #56

Earlier quoted context omitted.

And while I'm sure DocuSign is a very profitable product line, I also suspect that for many companies that use it (like financial firms) its cost is somewhere around their paper clip budget.

Yep. My first few mortgages involved getting all the right people in a room together at the same time and signing hundreds of documents, the last two were some websites and clicking. The amount of time not lost having people watch me perform magic with the pen must have saved way more than DocuSign cost.

I was seeing a discussion the other week about automation and someone was saying that, as a consumer, not that much has really been automated. We still need a person to clean the house, do the yardwork, cook (yes you can get meal delivery but again in urban areas that's not new), etc. Even if we do have major appliances they're pretty similar to what we've had for decades.

While that's true, it probably leaves out a lot of tasks that involved writing checks, running errands, going to various offices to sign things, etc. that have been, if not entirely eliminated, certainly cut back on.

Post reply on HN