Does anyone know id the docusign has more complex authentication behind the scenes? Like, if someone else has access to your email, how can you verify that they aren't "forging" your digital signature on docs? Maybe like, 2 factor auth would be enough for most cases.
The dubiousness of digitized signature services
41–50 of 70 posts
Re: The dubiousness of digitized signature services
#42Very recently, just before Pandemic hit India, we had to run around because one of the key Japanese counterpart was in USA and unable to send money (small amount) to complete a stock purchase. My response was, "Please login to your bank's website and do the transfer." That was the time I learnt that some (or maybe more) Japanese Banks still need the individual's personal Stamp/Seal to send money from their Banks. I l…
Last week I have seen a newsshow about a company digitizing those (quite pretty) seals. They also mentioned how Japanese are very fond of fax machines.
Something US-related instead of Japanese, is that cheques) or "checks" in US English) are still in common usage.
I run a B2B micro-ISV, and the number of times I've been mailed checks, despite slapping "NO CHECKS ACCEPTED" on everything, is ridiculous.
Re: The dubiousness of digitized signature services
#43Cryptographic signatures are a really new thing (1970's). Only a very low percentage of people actually know how they work, much less believe in them. They will eventually change a lot of things and count as a significant discovery. We still have a lot of work to do. Education is the first step.
Re: The dubiousness of digitized signature services
#44These signature services make no sense. My UK estate agent is trying to get me to use an American signature service to renew my lease. - What I get is an email from a third party (the signature service) with whom I have no business relationship. Why would I trust anything they say? - How do I know the agent has signed the lease? - What can I do if the American service claims I signed a contract when I didn't? If I si…
We refinanced during the pandemic with $MEGABANK, and they almost exclusively used third parties and email for the entire transaction. The last step was a total stranger (employed by another subcontractor we’d never heard of) stopping by our house and notarizing each signature in the closing paperwork. There was a day or two where we’d directed the previous lender to transfer title, and had already wired $100K’s to a…
The use of PKI referred to in the article isn't about domain names. PKI can be used for trust projection and verification beyond domain names, that is what the article refers to.
Re: The dubiousness of digitized signature services
#45These signature services make no sense. My UK estate agent is trying to get me to use an American signature service to renew my lease. - What I get is an email from a third party (the signature service) with whom I have no business relationship. Why would I trust anything they say? - How do I know the agent has signed the lease? - What can I do if the American service claims I signed a contract when I didn't? If I si…
It’s hard for programmers to understand signatures and law in general, because it is somewhat similar to programming but with very different rules.
The signature is just evidence of an agreement between you and the other party. It is not the only thing that matters. For example, if someone forged your signature on some paper transfer documents, would they then be able to move into your house? No.
In your scenario, it sounds like you’re worried about the third party signature service colluding with the other party and putting some terms in the contract that you didn’t agree to, while displaying the original contract to you when you sign?
If this is a genuine worry, just screenshot the document as you sign it. If the other party then tries to enforce these fraudulent terms, you can use the screenshots as evidence of the fraud. There may then be a criminal investigation, and everyone involved in the fraud may go to jail.
Re: The dubiousness of digitized signature services
#46I was interested at first because I built a signature product a few years ago. I find it a bit confusing and had to reread to catch the point.
There are 3 levels defined by the EU. I use these levels everywhere because it's not really a legal thing but increasing levels of technical requirement. The US has many conflicting laws on what signatures are valid.
The lowest level is what you first started out with. The marketing term for this is "E-signature". It's a subtle marketing speak to mean putting an image into a document. Theses are generally accepted for most things. California though has not allowed this in the past. A provider offers signatures at this level (with some nuance).
The second level is a "digital signature" backed up by other details. People think this means like an actual signature. In document contexts it's very confusing. But what they really mean is signing (encrypting with your private key so the public can decrypt it). This can be a verified email, phone, the more the better. What's important is at this level the signer is not actually the person, it's the service. The service has a trusted cert created from the Adobe trust chain and does additional measures to verify the person. The visible signature at this point is just a mock to make people comfortable using it. The signature is really cryptographic. This level is pretty much always court admissible.
The last level is signing the doc with your own trusted cert. You can get these tokens from many providers to do yourself. It's required for typically government things like stamping a document by an actual engineer (ie a PE). To get these certs you need to go to a notary to get verified. This is as legit as it gets. It's almost bulletproof.
Product wise, I am pretty familiar with PKI but am still confused as to what it really does or why I should use it. If this is to get wide adoption, the person using it needs to know nothing about certs and PKI. Additionally, I'm confused if this is using PKI or a web of trust. I'd think it would have to be web of trust to be practical but it seems like the examples allude more to PKI? Best of luck, I look forward to see where it goes.
Re: The dubiousness of digitized signature services
#47Earlier quoted context omitted.
I'm increasingly convinced that this is the way forward. Having a key verifiably tied to you as an individual goes a long way to enabling a broad range of governmental services. Digital voting, for one thing, but also no more need to rely on shady credit check companies for address verification, as I've seen on some (Canadian) government forms.
Or social security numbers in the US, which are absolutely not fit for this purpose. For those in the US who don't want a national ID: it wouldn't have to be one if the states issued their own. Yes, this would mean they'd all need the technical capability to operate a CA securely. Fund them enough to do that.
National IDs have a pretty bleak history - from being initially used to keep tabs on criminals to Jews under Nazi occupation. This is why they often are not mandatory.
As a curious factoid, in-between the world wars, it was popular for workers to have their ID number tatooed on their arm.
Re: The dubiousness of digitized signature services
#48Earlier quoted context omitted.
Last week I have seen a newsshow about a company digitizing those (quite pretty) seals. They also mentioned how Japanese are very fond of fax machines.
Something US-related instead of Japanese, is that cheques) or "checks" in US English) are still in common usage. I run a B2B micro-ISV, and the number of times I've been mailed checks, despite slapping "NO CHECKS ACCEPTED" on everything, is ridiculous.
I thought a business couldn't legally refuse checks, except for some places like supermarkets where there is a high risk of fraud?
Re: The dubiousness of digitized signature services
#49These signature services make no sense. My UK estate agent is trying to get me to use an American signature service to renew my lease. - What I get is an email from a third party (the signature service) with whom I have no business relationship. Why would I trust anything they say? - How do I know the agent has signed the lease? - What can I do if the American service claims I signed a contract when I didn't? If I si…
It’s hard for programmers to understand signatures and law in general, because it is somewhat similar to programming but with very different rules. The signature is just evidence of an agreement between you and the other party. It is not the only thing that matters. For example, if someone forged your signature on some paper transfer documents, would they then be able to move into your house? No. In your scenario, it…
I understand perfectly well that if it goes wrong I will, most likely, be able to unpick the damage. But I also understand that this can take years and lots of money. Especially if the signature service is in a different country. So-called identity theft is a real problem.
My particular concern is that I believe I'm entering into a tenancy but then discover, due to some bug in the software, that the landlord never actually entered the agreement. At this point the landlord can legally evict me if, say, he gets a better offer. What can I do about this?
Edit to explain a detail of English law: this is a lease renewal. It isn't necessary for my continued occupation, but without it I have no security of tenure.
Re: The dubiousness of digitized signature services
#50Earlier quoted context omitted.
We refinanced during the pandemic with $MEGABANK, and they almost exclusively used third parties and email for the entire transaction. The last step was a total stranger (employed by another subcontractor we’d never heard of) stopping by our house and notarizing each signature in the closing paperwork. There was a day or two where we’d directed the previous lender to transfer title, and had already wired $100K’s to a…
The use of PKI referred to in the article isn't about domain names. PKI can be used for trust projection and verification beyond domain names, that is what the article refers to.
My point is that banks are already abusing existing trust projection and verification mechanisms in consumer-hostile ways.
How would giving them even more expressive mechanisms for delegation of trust to third parties improve this situation?
Edit: I say that it is “consumer hostile” because they’ve used PKI and contract law to construct a complicated system of subcontractors that allows them to process mortgages without ever providing a single cryptographic proof that anyone involved in the transaction is a representative of the bank. (And the result is that many people have recently lost their homes to fraud.)