Hacker News new | ask | show | jobs
Ask HN: Are you concerned about your privacy when using services like DocuSign?
4 points by munduz 1720 days ago
Documents usually contain sensitive information and your signature. Documents are stored on server side in platforms like DocuSign (third party).
2 comments

I've had to sign quite a few documents this way. Of course the question of privacy nags at my brain as I recall the age old questions "Who do you trust, and why?" I do it anyway, because usually it means I'm signing on to a new gig, and usually the private info belongs to the other party asking me to sign anyway. If I don't sign, I don't get that gig. So, I scrawl something that is supposedly representative of my signature with my mouse.

Personally I wouldn't accept a signature made by mouse instead of a pen. How on Earth do you verify that? If you signed a cheque or voting form that way, it would be rejected. And I would reject it, too. I leave it otherwise to the receiver if they find a mouse scrawl the least bit acceptable.

It's much easier to get someone's legit signature than to verify the scrawl one makes with a mouse in its place. Need your city mayor's signature? Just Google it. Signatures show up everywhere. They're not as private as people tend to think they are. It's not as much of a concern, as long as you can provably deny a faked signature.

Having said that, I also would not use it to get someone to sign a document I sent them. I'd much rather you just autograph a piece of paper and hold it up to your monitor beside my document and take a picture with your cell phone. Yea, that's lame, but I'd trust it a whole lot more because there's (theoretically) no unrelated middle man, and a signature I could actually verify if I ever needed to.

I accept having to sign that way, but I don't like it. And because I don't like it, I won't ask anyone to sign something that way. What good is a chicken scratch that provably does not match the person's signature?

"verifying" signatures is an inherently insecure practice anyway. It's trivial to copy a signature any many people (like me) have poor writing that varies each time anyway. It's more about showing intent than verification.
Not really.

If you signed something and cannot make it look reasonably like what I understand your signature to look like, I have a really big red flag telling me you aren't who you say you are. Then I then have the option of denying you, or investigating why you can't match your own signature, and looking at other available proof of your ID.

People's signatures may change a little over time, but there are clear muscle-memory related aspects that don't disappear. It's the most basic aspect of handwriting their is - your own name. Usually it's the first thing you even learn how to write. If you can't do that, then you definitely need to carry plenty of other forms of ID that don't need your signature. And even your driver's license has that. Outside of physical or mental damage, there is very little excuse in the world for not being able to duplicate your own signature satisfactorily.

> Personally I wouldn't accept a signature made by mouse instead of a pen.

I had to implement a "signature" at my current gig and, legally speaking, a check-box is a valid signature when e-signing something.

It works for situations that you can expect no chance of repudiation or imposters. Then it is no different than an illiterate person signing with just an X.

Even a verbal agreement is legally binding and useful when repudiations and imposters are not likely.

Feel the same way.

Digital signatures are the way out when it comes to chicken scratch.

But there is no solution for privacy, have no idea if DocuSign like platforms have intend to comercialise sensitive information.

The solutions I've used are normally 2fa, and the alternative was sign a paper,scan it and email it which is less secure
As I understand, 2fa will bind your document to the information system that was used to share document. Ex: Court would ask evidence for second part identity event if 2fa used.

Have you ever faced these problems? I yes, how do you tackle these problems?

I've not had that issue and not sure on UK law here