Live data from Hacker News

Docuseal: Open-source DocuSign alternative

github.com

81–90 of 200 posts

Re: Docuseal: Open-source DocuSign alternative

#82
post #39

Earlier quoted context omitted.

Thank you for creating this and making it open source. What mechanism(s) is used to ensure non-repudiation? I appreciate that the demo is not behind a sign up wall, but is account creation and email verification required for invitees to sign any documents? Are IP addresses stored as part of the digital signature? Any other mechanism?

IP addresses and browser User Agent strings are stored for each signature/submission - those are the only measures for 'non-repudiation' currently available. but i think it doens't differ from other mainstream SaaS solutions - if you read through their terms of services - they put 'non-repudiation' liability on users of their services

Another method you might consider implementing would be identity verification via SMS code. I've experienced this with docusign: https://support.docusign.com/s/document-item?language=en_US&...

It requires you to know the phone number of the signer, but for important stuff you typically do.

Re: Docuseal: Open-source DocuSign alternative

#84
It's great to see fresh efforts being made in this space. I categorically refuse to use DocuSign, due to objectionable clauses in their Terms and Conditions ( https://www.docusign.com/legal/terms-and-conditions or https://archive.ph/y27U4). Some examples are below. As far as I'm concerned nobody should agree to use their service.

Unfortunately DocuSign has monopolized electronic signatures in some contexts (examples from my own local experience: healthcare, real estate), to the extent that it's become exceedingly difficult to request a simple PDF to print, hand-sign, scan and return. Such friction is common at companies who outsource their paperwork to third party workflow providers. I'm fortunate that folks I do business with tend to want my signature badly enough to escalate to someone with authority who can make a procedural exception, but I doubt everyone is so lucky and suspect many users are effectively "bullied" into accepting the Terms regardless of their wishes.

Clauses I find objectionable include:

- various consents to analytics, including use of my data to feed their machine learning (might have been more palatable if they provided some insight and stronger confidentiality assurances)

- 2.1.1 waiver of jury trials and class actions

- 8 indemnification (a and e are a little broad, I'm not going to pay for your lawyers in circumstances that don't warrant it)

- 9.2 is unfair; any damages caps should be reciprocal

- confusing and possibly overly-broad intellectual property rights clause 1.1 (they should explicitely restrict their protections to only DocuSign's IP, not "all IP").

- They expressly disclaim any warranties regarding accuracy, quality, fitness for purpose or that information they provide will be error-free. That feels dangerous in the context of forming contracts. A fundamental value proposition of their business is accuracy ("Oops we made a mistake and actually your counterpart did not really sign the document..."). Liability here falls back to the parties, and as a consumer I refuse to be liable for their mistakes.

- Nor am I a fan of increasingly common clauses along the lines of "we can modify our terms at any time and you'll be deemed to accept the revisions" or "you further agree to any other notices we might choose to inject elsewhere onto our site" or vague expectations I consent to additional third party licenses not disclosed at this time (and ironically some of their preamble along these lines seems to be in conflict with 10.8). If you and I agree to something, then later you want to change your mind, you'd better come back and seek fresh consent. If you're making changes so often as to make that annoying and inconvenient, then it's a sign you have too many salaried lawyers on staff and need to replace them with a team empowered to stop wasting my time and yours and get this right the first time. Customer attention is a precious resource, and companies sending out legal updates on a frequent basis can't possibly in good faith expect consumers to keep up with reading them.

- I take offense to their Terms page making connections to Twitter, Facebook, Salesforce, Google analytics, etc. and subjecting me to cookies prompts. All this is not required to simply provide me with your terms of use, and somewhat inappropriate seeing as I haven't yet consented to anything.

These are off their current website, but I recall similarly problematic terms the last time I started (and subsequently abandoned) a signature attempt some years back.

And don't even get me started on their Privacy policy. (Among the various problems... nobody should have to "opt out" of their personal data being sold to other parties).

Re: Docuseal: Open-source DocuSign alternative

#85

Can I redact text too? If not, is there any software close to Adobe Acrobats functionality?

You can try the latest version of Scribus for editing PDFs

I haven't used Scribus in some years. Would the apt version be good enough, or is there some bleeding edge tech they just released?

Re: Docuseal: Open-source DocuSign alternative

#87
post #58

Earlier quoted context omitted.

Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice. Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use. I wish smartcards took off and computers included readers as standard. Th…

The German eID has had that for years now. And it works pretty well. Only problem is that nobody uses it because our processes aren't adapted to it. The first time I used it for anything, apart from signing pgp keys, was to collect 200€ rent assistance and it worked flawlessly in 4 minutes.

Latvian eID also provides cryptographic signing, and it's widely used when communicating with governmental institutions, because it's mandated by law that they must accept such digitally signed documents, and they have the same legal power as regular documents. I believe the situation in Estonia and Lithuania is probably similar. Many businesses also accept them but it's not universal.

Re: Docuseal: Open-source DocuSign alternative

#88
post #67

Earlier quoted context omitted.

And yet it's the standard practice for normal people.

From my research this has 0 legal validity, at least in germany in regards to the EU eIDAS. They are just smoke and mirrors for companies to make them "feel" secure but without cryptographic ensurances (Advanced Electronic Signature) or TLS like Signed Cryptography (Qualified Electronic Signature) this is just as legally binding or not binding as an E-Mail

> just as legally binding or not binding as an E-Mail

Which is legally binding. In Germany most contracts are free-form contracts (Formfreiheit) and only need declarations of intent in the form of offer and acceptance. This can be a handshake or even a head shake.

Re: Docuseal: Open-source DocuSign alternative

#89
post #64

Earlier quoted context omitted.

I'm interested in reading more about #2, can you provide a source? https://www.docusign.com/products/electronic-signature/legal... doesn't mention anything about videos or passports. I could see how that might be one means a third party has chosen to collect proof of intent, but haven't found anything legally mandating it.

This may be german law specific, the overarching EU Legislation can be found by googlign "qualified electronic signature". In general they require complete, verified cryptographic signatures via smartcards or similar but because no one uses it, videoident has become the defacto alternative in germany

That's a misconception. Most contracts or form-free and can be made by handshake if one wants to. There are however some exceptions, which require either physical signatures or the qualified signatures as declared by eIDAS. Those exceptions are some employment contract and most things related to banking.

The need for identification over video, etc., has more to do with the know-your-customer laws.

Re: Docuseal: Open-source DocuSign alternative

#90
post #49

Earlier quoted context omitted.

One of the tough things about a party-controlled, self-hosted e-signature is that it becomes easier to repudiate because a party to the contract has custody of the platform. The non-custodial party can claim they never signed, and when the custodial party produces evidence of IP address and timestamp, the non-custodial party may have a credible argument that they are faked and the person asserting those authenticated…

> That argument is much harder to assert with something like DocuSign because it is unlikely DocuSign would put their business on the line to fake someone's signature. This seems like the claim that the USG will be unlikely to put it's Military on the line so they won't leak any tank designs on discord. Happy to concede that the CEO of DocuSign wouldn't do this but surely some 15$/h employee doesn't have that same op…

The support person should not have that kind of access without auditability and traceability. Even Sundar should not be able to log into a console and read your emails either.
Post reply on HN