This question already has an answer here:

[Note: This is not a duplicate of Are documents truly "signed" by DocuSign?. That page does not have an answer to the specific question I am asking in the final paragraph, below. This page, however, does. Hence, not a duplicate.]

HelloTech has a series of documents they want potential technicians to sign. These are delivered by an email containing a link to their documents in the HelloSign document-signing service. Clicking this link sends the potential technician to a document they can sign, but there is no authentication step to verify that the person that's signing the document is who they say they are.

Since anyone could intercept the unauthenticated email link in transit and impersonate the signer, how could the document-signing service verify that someone who signed a particular document really did so?

marked as duplicate by Xander, Steve, Rory Alsop Dec 2 '16 at 12:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 3
    This answer about a similar service, Docusign, may hold some answers for you. security.stackexchange.com/questions/116896/… – John Nov 29 '16 at 21:48
  • 1
    This is effectively a duplicate of the DocuSign question. Ultimately, the risk of an email being intercepted by someone who wants to fraudulently sign a document on behalf of the intended recipient, and then that leading into a situation requiring litigation is so remote as to be negligable, and not worth worrying about. Technically email is insecure. Practically, it's used to transmit massive amounts of data of varying sensitivity on a daily basis, and the overwhelming majority of that data is not illicitly captured or abused. – Xander Nov 29 '16 at 23:03
  • 1
    The other question about DocuSign does not actually address the specific question I am asking here (unless I am missing something). I already read that question before posting this one. The last paragraph is the real "meat" of the question. – Bill_Stewart Nov 30 '16 at 0:16
  • @Bill_Stewart Unless I am missing something it is basically asking the same question but in a different way. Even if the scenario is different you and the Docusign question are still asking how they can validate an unauthenticated, unidentified, or forged signature. – Bacon Brad Nov 30 '16 at 1:46
  • This question has the specific answer being asked here; the other question does not have an answer to this specific question. – Bill_Stewart Nov 30 '16 at 13:49

how could the document-signing service verify that someone who signed a particular document really did so?

They don't. They do create a log showing the IP address of the remote computer that issued the "signature"; but they can't identify the legal entity that caused the signature to be made. If the identity of the signer turns out to be in dispute, the parties to the dispute can assemble evidence about that later on.

This sort of functionality is provided in the meat world by a notary public or the medallion signature guarantee system.

  • Very strange that they say that they comply with eIDAS laws. I don't thing that is in any way possible, just look at the requirements. But then I doubt they would dare to blatantly lie on their webpage, because that obviously would sooner or later result in lawsuits. That's confusing. – Josef Nov 30 '16 at 8:58
  • An e-mailed link that requires no authentication is a bit like a notary that does not check your ID. I would recommend using a more reputable witness. – Bill_Stewart Nov 30 '16 at 11:10
  • This problem is no longer theoretical, by the way. I recently received an email containing a link to signed documents I didn't sign. I stand by my assessment that an emailed link is not secure without some other form of authentication. – Bill_Stewart Aug 1 '17 at 0:34

Is it simply a click? Is there any other sign on or entry of a key that isn't sent in the email?

With a simple email, there is no way to differentiate from the legitimate technician from someone who has intercepted his or her email. They may consider this acceptable, however - considering this reputability worth living with for the simplicity.

It may be, however, there's an extra protection here. If the technician has logged in before this email is sent, there may be data in a site cookie that can be checked on the server, so that they at least can demonstrate that that computer has logged into the technician's account.

  • 1
    No, it is just a link. I tested this by creating a free HelloSign account, uploading a document, and sending to a dummy email address that does not have a HelloSign account. I sent the document to the dummy account requesting a signature, and I copied the link from the email and opened it. I could sign as that person without any account or authentication. I am puzzling over how a company would accept this kind of risk. – Bill_Stewart Nov 29 '16 at 21:20
  • From an anonymous browser session? Ie, no cookies for that account? If not, I'm not sure what their thought process is there. – crovers Nov 29 '16 at 22:10
  • Correct; anonymous. Cleared cache and cookies and was able to sign without any authentication whatsoever. – Bill_Stewart Nov 29 '16 at 22:25
  • Then I guess they are just living with the uncertainty. Seems weird. I guess you could ask them? – crovers Nov 30 '16 at 13:44
  • 1
    See answer from 'Alex M' and following comments. – Bill_Stewart Nov 30 '16 at 13:46

My name is Alex M. and I work in API Support at HelloSign.com. Regarding the legality of HelloSign signatures, there's an explanation on why we believe our esignatures are legal on our website.

HelloSign authenticates document signers so you know who is signing your documents. Any person signing a document via HelloSign must either have login information for HelloSign, or have received in their email account a request for signature.

To protect HelloSign user accounts, all user information transferred is 256-bit SSL encrypted, including usernames and passwords. We also seek to prevent others from accessing or using your account by imposing automated session time-outs, and emailing you every time a contract is sent to, received by, or signed under your account.

You’re right though, one would need access to the email to get the link, and by default there’s no second step - it’s typical SSO. There is also an audit trail provided that lists more details on the signer, like time and date signed as well as IP address used to sign.

Also, API customers could use a kind of two factor authentication by way of a signer pin. This is an alpha-numeric pin that should be sent to the signer in some other fashion (via text or over a phone call or in person - something other than being sent to the same email address as the signature request email).

The usage is in our documentation, and how you include the signer pin depends on a number of factors. For instance though, in the name of answering as much as possible here instead of just including links, in cURL when hitting POST /signature_request/send, you’d include a parameter like this: -F 'signer[1][pin]=1234'

Then when signers clicks the link in their email, they first see a page asking for the PIN to access the document.

If anyone has any additional questions, please reach out to us at apisupport@hellosign.com.

  • 2
    The question here is not about document storage or SSL. We all understand that is secure. The problem is that email is not secure. Anyone can read one of these links in transit (email is clear-text!) and sign as someone else. So I don't see how it's possible that "HelloSign authenticates document signers so you know who is signing your documents" without some form of authentication. – Bill_Stewart Nov 29 '16 at 22:37
  • 1
    @Bill_Stewart I actually think this addresses your question: SSO, pin before signing. Someone would have to have the email link, the SSO credentials, and the pin. – schroeder Nov 29 '16 at 22:53
  • It is good that this is an option, but the vulnerability we're talking about here is that HelloSign allows you to send links that don't require authentication. In an age of identity theft, it is frankly surprising to me that they allow this. It puts anyone who signs something like this at risk. I would never electronically sign something sent to me that does not have some form of authentication. – Bill_Stewart Nov 29 '16 at 22:59
  • 1
    @Bill_Stewart So, you know how it works then...What is your question? What you personally would or would not be willing to do is irrelevant, and discussions about whether this is in general terms is "secure enough" or not is ultimately opinion based and therefore off-topic. – Xander Nov 29 '16 at 23:10
  • "discussions about whether this is in general terms is 'secure enough' or not is ultimately opinion based" - I guess I disagree (?). I don't see how a link emailed over the Internet in a clear-text email can in any way be considered secure (let alone "secure enough"). – Bill_Stewart Nov 30 '16 at 0:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.