DocuSeal – Open-source Document Signing

>2. Cryptographic signature, using Public Key Infrastructure (PKI), etc. This isn't really practical until we have widespread client certificates, or something like EIP-712 in mainstream usage.

It's very practical and used in certain jurisdictions, with very high rollout rate of personal certificates. Within EU regulatory framework it's also a thing and has legal meaning, then there is US government with their weird fixation on contact-only smartcards.

That being said, it's globally deployed with an "advanced", rather then "qualified" profile, where provider applies a signature with their own certificate (or ethemeral certificate issued to user on the spot) and embeds it into pdf as a field.

European Commission even has a library [0] in addition to the law for that.

It's kind of a mess, but nobody really cares until somebody tries to challenge validity of their own signature, which is very very rare. As a former industry insider I would say it's all a security theater and you can as well exchange emails to confirm existence of a contract. It's just more convenient to have a document with a signature as a single artifact, even if it's produced in ms pain as you rightly suggest.

[0] https://ec.europa.eu/digital-building-blocks/sites/display/D...

> If you want this, just use MS Paint or similar tools.

Except then you need to have people install those tools and know how to use them correctly. I think eSign platforms can still provide some value here in terms of usability even if that's not the core value proposition.

Thank you for supporting our open source company. We really appreciate it.

None of the features you bill as "enterprise focused" are limited in usefulness to large enterprises. Everyone doing anything beyond trivial would likely benefit from one or more of these features. I get the need to have a working business model, I just find the way it is presented a bit frustrating. Still yet, thank you for creating open source software. Even a half-complete open source solution is better than no open source software! I really appreciate all open source contributors of all sorts! Thank you.

Just for the sake of security, SSO should never be an enterprise only feature, yet almost everybody locks it behind high prices.

We appreciate your support. Yeah we agree that many Saas solutions offer too little for too much money given how much computing costs have gone down in the last 20 years. We hope consumers continue to vote for models like ours.

We haven't had any customers confused about it. Seal and Sign are distinctly different words and haven't seen any evidence of confusion.

Only a court can really decide that

I'll add that i did do a double take here, so you have a point

Please please make CocaKaka I will buy it.

(I’m not a lawyer.)

Some lawyer friends I have (here in Australia) have told me that electronic signatures (of the kind like DocuSign and Adobe Sign that have you “adopt” a digital signature and click a “Sign” button) should only be used in situations where the other party’s actions soon after signing will confirm their intention to be bound by the document.

For example, if there is a sales contract and the buyer proceeds to pay the money, then that payment shows intent to follow the purchase agreement.

Or, if someone sends an email after signing saying “All done. I look forward to working with you.” — that has the same effect.

To use it for something where the other party will be doing nothing for a long time (like a guarantor on a loan or lease) or acting unpredictably (like a house tenant) would be very risky. The other party could easily use the defence of “I didn’t click the button… I didn’t even know about the contract.” even if they did know and did click the button.

So why use a digital signing system? Efficiency!

It’s quicker and easier. You can get dozens done with the same time & effort it takes to arrange a single wet signature. It’s multilingual. It’s automated. It’s fancy!

Having any signature, whether wet or digital, shows that your side is following proper process. The signing of a document is an important moment, and the specific date & time often has real commercial, accounting or legal ramifications. Even if you could easily show to a court that the other party has “agreed” without signing (e.g. via email, text, phone, etc) and is acting in accordance, it’s better to just avoid the court in the first place.

To summarise:

Wet signatures are best. The other party would be crazy to challenge them.

Digital signatures are better than just an email saying “I agree.” The other party would have to be brave to challenge one.

An email saying “I agree” is better than a handshake.

(Again, I’m not a lawyer! I would love to hear a lawyer’s opinion. Though, please do so anonymously — I don’t want anyone getting in trouble!)

There are many ways, but a popular option is to add a “PDF Advanced Electronic Signature” (PAdES) compliant approval signature on the PDF file. You can tack on as many of these on a PDF as you wish, and they have a visual component you can control and place where you want. Most PDF readers support these and can verify the signatures using a PKI system similar as is used with HTTPS. Adobe Reader is a popular choice. Notably Apple's Preview.app does not support verifying PDF signatures.

In the EU, often a personal key on a tamperproof personal device is used. In many EU countries these are readily available to citizens and the resulting signatures carry the signer's name, a unique personal ID code, and have the same legal effect as a handwritten signature. This is called a "qualified electronic signature". Qualified trust service providers verify the identities of people and provision the hardware to them.

The EU system is great in that when creating or verifying signatures, you don't necessarily need a service provider at all — the software is free. Of course a good system can help managing signature invitations, the documents, archival, reminders, etc. But it's not needed for security; in fact the most secure way would be to not give your documents to a third party at all.

Alternatively, the e-signing providers private key can be used to create a seal on behalf of the person signing. It's then up to the security of the e-signing provider, how they validate the signer's identity, etc, to decide how trustworthy such a signature is.

There is a spectrum between copy-pasting a picture into a pdf and actually requiring user to bring their own CA-endorsed key material to produce an artifact. The most practical compromise is performing all cryptography on a service provider's environment with HSM and all that and issuing the end user ephemeral certificate on the spot, tied to their email.

In the end you can't modify (actually you can, because PDF, but it's a different problem) the data without breaking crypto signature, but identity that is proven by this operation is not government-endorsed. Everybody is mostly fine with a status quo.

In our business, the chain of custody (i.e. audit logs and where the software runs) is the most important security aspect. Not one of our bank clients seem interested in digitally signing their documents, or otherwise "baking-in" any sort of non-repudiation aspect at the PDF-level. For their business, non-repudiation is realized as an emergent property between document cold storage, core system records, and exquisitely-detailed audit trails (also committed to document cold storage).

For us, the biggest question that comes up for our customers is the variety of signature specimen we intend to work with and how it will be applied to the final documents (the ones the bank would take to court):

  1. No signature captured at all. 
  2. Signature captured using adoption of a machine-generated specimen.
  3. Signature captured using touch, mouse or stylus.
  4. Signature captured using a paper specimen & CCD.
  5. Actual wet signature on paper with in-person presence required.

Option 1 seems to be the most popular with the latest wave of online banking products. Option 3 is the happy path for our in-branch product, but we have some cases fall into the Option 5 bucket as well - typically only when all signers cannot be present simultaneously for non-consumer accounts.

Depending on the liability associated with the customer/account combo, the required quality of the signature specimen could vary. Some of our customers will allow for basic consumer accounts to be opened with minimal backing documentation because the limits on those products are relatively low (and relative volume is VERY high). For business customers & accounts, we are in a completely different universe. You take that stuff a lot slower. Businesses are typically much more understanding when you say you can't give them an active account right now.

The most important foundation to all of this is Know Your Customer (KYC). That entire process is designed to ensure that whoever you are pulling into the core system is exactly who they say they are, so that all subsequent business with that individual can be correctly attributed to the appropriate natural person. Once you have a 'hardened' customer information file, you can start to do scary business because you are now reasonably-confident you could win in court.

We have 2FA, email verification and other processes to verify that the document is signed by the same person that received the email for signature requests. This level of security is sufficient for simple signatures and applies to most businesses. Some specific industries might require advanced signatures to where the signer needs to submit their ID to verify themselves before signing. These types of signatures are usually very expensive and only apply to certain industries.

They did take off, it's just hiding really well, because digital (as opposed to electronic) part of the signature isn't a feature you pay for, it's an implementation detail you are not supposed to care about.

For a start, PDFs only /look/ simple. The PDF format is Byzantine and very few viewers implement all of it. Making a PDF editor is much, much worse and the market of people who need to modify, rather then generate or view, PDFs and who can pay for an alternative rather than have their company use Adobe seems to be quite small.

I'm not sure what you define as "viable". Firefox and Chromium both have built-in PDF readers, and I believe both now allow for a t least basic form filling in. Okular is another open source PDF reader that allows for filling and even annotations that can be used to sign a document.

Probably the same reason so much of everything is an online service: to hoover your data and sell it.

I am not very familiar with the e-sign space. But can't you just create a signature certificate with any name you want [1] to sign [2] only verifying PDF integrity ? Which mean that if you want a custom trust chain (you choose who to issue certs for), for verified signers, you have to roll your own certificate solutions? which these kind of product wrap nicely.

[1] https://helpx.adobe.com/acrobat/using/digital-ids.html

[2] https://helpx.adobe.com/acrobat/using/certificate-based-sign...

Preview app on a mac is enough to sign a pdf.

The management and tracking of the documents presumably. You can sign a doc yourself but how do you manage keys? Where do you store the doc for auditing etc.

Why would anyone pay Acrobat $15/mo???

We are eIDAS first level compliant. For the US, we follow UETA and the ESIGN Act by satisfying Record Retention and collecting/generating Audit Trails. Please feel free to peruse our compliance page on our website.

Seems so: https://www.docuseal.co/compliance

Thanks for your support.