7

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said disclaimer, before being granted access to a download area. After the disclaimer has been signed for, we would also like a feedback system in the form of an automated email, which is sent back to a designated address. I am clueless in this department so I am wondering what is the best way to implement this - most likely best left to a professional but any response here would be great!

I had imagined the process to be as follows:-

  1. Company sends a client a pin number and project reference number which is unique to a particular download area (each project we work on and intend to submit to a client would in theory have it's own download area)
  2. Client visits a page on our website where they enter the reference number and pin number we provide them with, which takes them to their specific disclaimer (disclaimer is different for every project)
  3. Client reads disclaimer, signs an electronic signature by providing name, job title and probably some other information yet to be decided.
  4. Client is granted access to the download area specific to that project and is able to download the files within.
  5. Once the electronic signature is signed, an automated email is sent to a designated address to provide us confirmation and evidence of the client's access.

A few further notes:-

  • A web-based system would be ideal so it can be integrated into our website - we set up the project on a webpage, entering the specific disclaimer details and uploading the relevant files.
  • If the client wishes to gain access to the file area again, they just have to re-enter the reference number and pin number which then bypasses the disclaimer form. However, We must have the option to force the client to re-sign if for example we update some files within the download area.
  • To avoid the risk of duplicate pins being issued owing to human error or whatever, some level of automation which provides a randomly generated pin would be great too. We could use a random number generator every time but it would help if the process was streamlined.

I have come across the following - https://www.universign.eu/en/timestamp/ - which seems to be what I'm after but again, the implementation into a website is beyond me.

Improve this question
7
  • 1
    It looks like you just want electronic signatures, rather than the cryptographic kind, although you should clarify that. ​ ​
    – user49075
    Commented Jan 7, 2016 at 10:55
  • Electronic signature is what I'm after I think. I work for an engineering company and that small passage at the start of the article applies to my situation. Question clarified.
    – Phizzy
    Commented Jan 7, 2016 at 11:04
  • The client can provide a secret phrase in a text box as his signature which is kind of unique to him and the final digital singature can then be generated based on that info
    – Ijaz Ahmad
    Commented Jan 7, 2016 at 14:05
  • 1
    The good thing about digital signatures is that there is non-repudiation (i.e. the end-customer can not deny that he accepted the license agreement - legally speaking).
    – Stef Heylen
    Commented Jan 7, 2016 at 15:07
  • 1
    Ah I understand, however, this is not for legal reasons. It's only for quality management so it doesn't need to be as sensitive.
    – Phizzy
    Commented Jan 7, 2016 at 15:15

2 Answers 2

Reset to default
2

It is worth noting that numerous services exist online that do this sort of thing. Accellion, LiquidFiles, Dropbox, Box.com, and numerous others can grant you this kind of functionality. Depending on volume and complexity, you might even be able to leverage some marketing-oriented online service like salesforce.com or hubspot.

There are a zillion things that you do wrong in trying to do it yourself. You should definitely consider signing up for an existing online service or installing software that does this.

Improve this answer
1

So here's a quick sketch of what I would do here.

  1. Assign each user a pin on registration. Make sure it's secret. https://codereview.stackexchange.com/questions/61338/generate-random-numbers-without-repetitions Should give you a good way to do this with no repeats. Be sure to pick a sufficiently large number of digits!
  2. Have a page with boxes for the reference number and pin, along with a Turing test such as a CAPTCHA [1] to prevent brute-forcing.
  3. When the user wants to download a file, present a ToS box with all the legalese, then have boxes for Name, Job Title, etc. Have them tick the box.
  4. As part of the download routine, look up the email and send a confirmation.
  5. Be sure that they cannot forcefully browse to the file location. Have a check that makes sure you have actually gone through the process by looking for a unique token (given in step 1 or 2) every time. Do not allow this value to be reused.

For more information on the big issues of software development, I'd recommend reading the OWASP Top 10: https://www.owasp.org/index.php/Top_10_2013

[1]: Please note that CAPTCHA is not W3C accessible. More reading: http://simplyaccessible.com/article/googles-no-captcha/, https://www.w3.org/TR/turingtest/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .