Docuseal: Open-source DocuSign alternative • Hacker News Board

Re: Docuseal: Open-source DocuSign alternative

#161

Post by yencabulator » Thu, Jul 20, 2023, 9:14 PM UTC

dboreham wrote: post #74

hkhanna wrote: post #49

Earlier quoted context omitted.

One of the tough things about a party-controlled, self-hosted e-signature is that it becomes easier to repudiate because a party to the contract has custody of the platform. The non-custodial party can claim they never signed, and when the custodial party produces evidence of IP address and timestamp, the non-custodial party may have a credible argument that they are faked and the person asserting those authenticated…

If only someone would invent a public nonrepudiatable ledger.

The problem is that it would require everyone to monitor the ledger for falsified versions of their own signature. That works a lot better in the world of Certificate Transparency where Google can scan for google.com registrations. It does not scale well to every human being doing that, or outsourcing it.

The fundamental challenge here is that there's no way to tell, based on a the signature alone, which signatures are "valid" and which are "forged"; they're not cryptographic signatures. And getting cryptographic signatures for lay people is apparently too hard to do, outside of Estonia's digital citizenship initiatives.

It might be neat if the big guys agreed on an OIDC extension that let you piggyback text to be affirmed by the user. Cryptographic proof that jane.doe@gmail.com saw text with hash H at time T and chose "Accept".

Re: Docuseal: Open-source DocuSign alternative

#162

Post by yencabulator » Thu, Jul 20, 2023, 9:15 PM UTC

yokem55 wrote: post #147

ooterness wrote: post #95

Earlier quoted context omitted.

Like a chain of blocks? Where each block is signed by adding a prefix that produces an increasingly difficult hash?

It could probably be done with a merkle based signature log that whoever is hosting the service could provide. To cheat, the party hosting it would probably have to forge signatures for everyone after the disputed signature.

As long as we're talking about non-cryptographic-signatures, the party hosting the e-signing software can claim any signature to have happened at any time. The whole point was DocuSign would be unlikely to do this.

Re: Docuseal: Open-source DocuSign alternative

#163

Post by yencabulator » Thu, Jul 20, 2023, 9:23 PM UTC

bob1029 wrote: post #130

somery wrote: post #124

Earlier quoted context omitted.

That's interesting that you ended up developing an in-house document e-signing feature for your product. I'm curious, would it be possible for you to choose a self-hosted and open-source solution like Docuseal, integrated with your product to outsource the complexity and speed up the development? (if such an option existed back then?)

> outsource the complexity Honestly the bulk of complexity seemed to emerge from the mismatch between what we thought would be a good e-sign API and what APIs were actually available. The way our product works, we need to have access to the raw signature specimen at various stages of the signing process because we have a document generation feature that dynamically inserts the specimens into the appropriate fields. P…

> Put differently, we don't show the documents until we first have a signature (and initials) specimen collected from the e-sign participant.

Why would I sign something I haven't seen?

Businesses & government in USA seems to like asking for my signature on a little LCD pad, without showing me what I'm signing. That's absolutely horrible and anti-consumer behavior.

(And yes, I do diff DocuSign-style PDFs before and after the insertion of the pseudosignatures and visible watermarks, or PDFs from before and after a email-print-sign-scan-email cycle.)

Re: Docuseal: Open-source DocuSign alternative

#164

Post by gamblor956 » Thu, Jul 20, 2023, 9:30 PM UTC

_jal wrote: post #138

gamblor956 wrote: post #132

Earlier quoted context omitted.

Not really applicable, in that situation there were local court rules requiring physical documents and "wet" signatures (i.e., signed in person with a pen). The UST specifically noted that absent those rules DocuSign would have been acceptable. Also...the article is from 7 years ago...

Of course it is applicable. The Docusign users failed to use it in a way that would be legally valid. If you have a more recent case that seems relevant or invalidates that result, post it. Otherwise I'm not sure what being 7 years old has to do with anything.

You're attempting to make a mountain of a single instance, years ago, of an electronic signature being rejected by a non-judicial officer in a quasi-judicial proceeding and trying to make it out like a general policy when it is so rare an exception that no court before or since has ruled against the consensual use of electronic signatures by the parties.

If you have any evidence that electronic signatures can't be used in court proceedings, and not just in the limited circumstance of one US Trustee's meeting room, the onus is on you.

Re: Docuseal: Open-source DocuSign alternative

#165

Post by etothepii » Thu, Jul 20, 2023, 9:46 PM UTC

dtx1 wrote: post #67

infogulch wrote: post #50

Earlier quoted context omitted.

And yet it's the standard practice for normal people.

From my research this has 0 legal validity, at least in germany in regards to the EU eIDAS. They are just smoke and mirrors for companies to make them "feel" secure but without cryptographic ensurances (Advanced Electronic Signature) or TLS like Signed Cryptography (Qualified Electronic Signature) this is just as legally binding or not binding as an E-Mail

Unless you are a qualified lawyer it would be polite to begin a comment like this with IANAL.

IANAL but in the common law world a contract requires 3 things:

* Offer and acceptance

* Consideration (something of value)

* An intention to form legal relations.

Acceptance is, of course, what a signature signifies. Acceptance is "a matter of fact" and thus in reality pretty much anything will do.

Re: Docuseal: Open-source DocuSign alternative

#166

Post by owenmarshall » Thu, Jul 20, 2023, 9:55 PM UTC

colechristensen wrote: post #68

jazzyjackson wrote: post #9

Earlier quoted context omitted.

> What justification do the e-signature SaaS companies have for their exorbitant prices? They will defend their digital signature in court. I was shocked to find these "click here to sign" contracts manage to do it all without an ounce of cryptography, but the fact is lawyers don't need cold hard math, they need a warm body to be a subject matter expert to explain to a jury that unless you're claiming someone else ha…

I had to get a notary to sign my I-9 form for a new remote job. The process of identity verification involved a seemingly 19 year old dude looking at my ID and then signing a piece of paper. A website sending you an email and tracking your IP and keeping a log... seems to be about the same level of trust to be honest.

Ageism aside, you are describing a system where an unrelated third party who has experience validating state/federal identity documents validated yours, visually compared the person presenting the documents to the picture on the ID, then signed a log in his possession that he’d testify to in court if needed.

That feels like a pretty damn good system to me, and far beyond the system you handwave at. Where’s the complaint?

Re: Docuseal: Open-source DocuSign alternative

#167

Post by TheNewsIsHere » Thu, Jul 20, 2023, 9:59 PM UTC

cseleborg wrote: post #119

ooterness wrote: post #95

Earlier quoted context omitted.

Like a chain of blocks? Where each block is signed by adding a prefix that produces an increasingly difficult hash?

Wait... You're talking about Git, right? Brilliant idea! You could sign a pull request, and once it's signed, you can then merge the businesses. But how do you show a diff of the signature? And what if it's not for a corporate merger?

That’s just crazy talk. Corporate mergers are the only transactions there are!

Re: Docuseal: Open-source DocuSign alternative

#168

Post by TheNewsIsHere » Thu, Jul 20, 2023, 10:03 PM UTC

etothepii wrote: post #165

dtx1 wrote: post #67

Earlier quoted context omitted.

From my research this has 0 legal validity, at least in germany in regards to the EU eIDAS. They are just smoke and mirrors for companies to make them "feel" secure but without cryptographic ensurances (Advanced Electronic Signature) or TLS like Signed Cryptography (Qualified Electronic Signature) this is just as legally binding or not binding as an E-Mail

Unless you are a qualified lawyer it would be polite to begin a comment like this with IANAL. IANAL but in the common law world a contract requires 3 things: * Offer and acceptance * Consideration (something of value) * An intention to form legal relations. Acceptance is, of course, what a signature signifies. Acceptance is "a matter of fact" and thus in reality pretty much anything will do.

Yeah, it’s not like in the spirit of the law you can perform your part of the contract and then get away with saying “I never agreed”.

In the US, we have a federal law that covers electronic contract signing. I believe it’s part of the UCC? (I’m not an attorney, and that area isn’t one I practice with in tech either.)

Re: Docuseal: Open-source DocuSign alternative

#169

Post by bob1029 » Thu, Jul 20, 2023, 10:35 PM UTC

pottertheotter wrote: post #150

bob1029 wrote: post #130

Earlier quoted context omitted.

> outsource the complexity Honestly the bulk of complexity seemed to emerge from the mismatch between what we thought would be a good e-sign API and what APIs were actually available. The way our product works, we need to have access to the raw signature specimen at various stages of the signing process because we have a document generation feature that dynamically inserts the specimens into the appropriate fields. P…

> The way our product works, we need to have access to the raw signature specimen at various stages of the signing process because we have a document generation feature that dynamically inserts the specimens into the appropriate fields. Put differently, we don't show the documents until we first have a signature (and initials) specimen collected from the e-sign participant. This is basically the exact opposite of how…

In our solution, providing the up-front signature does not construe immediate consent to terms of whatever hypothetical documents. We have a subsequent review phase where the customer is expected to confirm each document meets their expectations (i.e. with their actual signature on it). Only after confirming all of the documents is the transaction considered to be completed and the signed copies taken as official.

The more complicated answer is that we are serving e-signatures for business accounts wherein there might be 10+ authorized signers involved. In these cases, we want to permit parallel sign completion. To allow this, each signer gets to view an isolated scope of documents with just their signature affixed. This also helps to conceal the signature specimens of other parties until the entire transaction is considered finalized. If a required party to an account does not want to participate, then no one gets to see anyone else's ink.

At the very end, all participants of the signing ceremony receive emailed copy of documents that combine signatures from all participants.

Re: Docuseal: Open-source DocuSign alternative

#170

Post by yencabulator » Thu, Jul 20, 2023, 10:35 PM UTC

somery wrote: post #108

_ea1k wrote: post #56

Earlier quoted context omitted.

I do wonder about that for self-hosting a service like this. But how often do actual disputes arise between parties as to whether a document was actually signed or fraudulently altered? TBH, even a contract rests on a certain amount of trust between the involved parties.

When selfhosting it - it's possible to connect AWS S3 to store the documents - AWS with S3 logs could be used as a source of trust to ensure the documents are not altered.

Nothing prevents the person running the software from submitting a "bad document" stating anything they want, with plausible IPs and timestamps etc. That is the problem.

A third party like DocuSign is somewhat comparable to using an escrow company to buy a house. You trust the escrow company to not steal the money, but you don't have to trust the seller. You trust DocuSign to not forge document metadata.