Hacker News Reader

Comment by supermatt | Hacker News Reader

The way a system like docusign works is that it is a (trusted) independent third party that will verify that the owner of email address X is the one that "signed" the specific version of an agreement.

By self-hosting, you have access to the infrastructure and can manipulate it to your will. There is no proof that the counterparty signed anything - you could just manipulate it to say they did.

This potential for misuse could make it difficult to enforce your contract should you be required to do so.

View on HN

I mean both parties have an email receipt (but then why not just use email)

I think the infrastructure need here is extensible messaging. There are a lot of multiparty flows with notification and recordkeeping requirements

I do wonder about that for self-hosting a service like this. But how often do actual disputes arise between parties as to whether a document was actually signed or fraudulently altered?

TBH, even a contract rests on a certain amount of trust between the involved parties.

When selfhosting it - it's possible to connect AWS S3 to store the documents - AWS with S3 logs could be used as a source of trust to ensure the documents are not altered.

Nothing prevents the person running the software from submitting a "bad document" stating anything they want, with plausible IPs and timestamps etc. That is the problem.

A third party like DocuSign is somewhat comparable to using an escrow company to buy a house. You trust the escrow company to not steal the money, but you don't have to trust the seller. You trust DocuSign to not forge document metadata.

It's not about how often but about if a dispute arises. If in that case the signature can't be trusted why signing in the first place?

Not entirely true, cryptographic signatures exist. For example the EU eIDAS Law allows Advanced Cryptographic Signatures to basically just be PGP Signed Emails

Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice.

Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use.

I wish smartcards took off and computers included readers as standard. This would not only solve strong authentication but also payments (just insert your bank card and do EMV-style payments with comparable levels of security).

The German eID has had that for years now. And it works pretty well. Only problem is that nobody uses it because our processes aren't adapted to it.

The first time I used it for anything, apart from signing pgp keys, was to collect 200€ rent assistance and it worked flawlessly in 4 minutes.

Latvian eID also provides cryptographic signing, and it's widely used when communicating with governmental institutions, because it's mandated by law that they must accept such digitally signed documents, and they have the same legal power as regular documents. I believe the situation in Estonia and Lithuania is probably similar. Many businesses also accept them but it's not universal.

We do use this type of signatures here but for specific use cases, generally with administration like bodies, but not only. Generally speaking, the basic eSign covers 9x% of the needs.

I can sign documents with my goverment ID card, I use my phone NFC as card reader in my computer with an goverment app, it is kind of clunky but it works.

Yeah, we use them here in Lithuania - but I have never seen them used for private contracts.

I'm not even sure how i can use my signature outside the AWFUL experience that is the government esig portal.

I dont think they are accessible for non-resident entities either - i.e. i can only get lithuanian signatures through the lithuanian portal.

This likely explains why they arent used b2b as you would need a separate contract process for foreign and domestic.

Reply on news.ycombinator.com