How online document signing services guarantee non-repudiation?

Question

There is a number of services online like RightSignature or SignHub that will let you sign online legally binding documents. I understand how documents can be signed digitally and this can guarantee that they were not altered, but I do not understand how they can guarantee non-repudiation. For example, I just created an account for John Doe and all information I had to provide was an email. As you can imagine, my name is not John Doe. What is to prevent an interested party to create a fake account for the other party and sign the document in his name? I guess I am missing something simple here :)

So, how these documents signed online can be legally binding when no one checked my identity?

Answer 1

Legal matters depend on jurisdiction, and there are a lot of those. However, in many of them, a signature is "legally-binding" if the signer really did it. When you sign, how you do it does not matter as far as legal binding is defined; putting your name at the end of an email is also a legally binding signature. Several cases have shown that an oral agreement with a handshake in Hollywood can also be legally binding.

The methods used to produce the signature matter not for defining whether the signature is legally binding, but for proving it. Roughly put, in case of contest, the purported signer will claim that he did not do it, while his opponent will be intent on demonstrating that he is a filthy liar and indeed "signed" whatever document is at the heart of the dispute. Depending on the technical details of the signature mechanism, judges will then consider that the burden of proof lies on the party who claims the signature validity, or on the party who disputes it, or somewhere in between.

In France, there is a (relatively new) notion of signature qualifiée, meaning that a system has been audited and certified and exhibits sufficiently robust security qualities (including use of asymmetric cryptography, but also appropriate authentication mechanisms for certificate issuance and similar things) that the burden of proof automatically lies on whoever claims that the signature is fake -- he may still win, but he will have to work it through.

None of this is really new; after all, we have long been "signing" documents by dropping ink smudges on paper, and these have been known for centuries to be relatively easy to counterfeit. What makes paper signatures tolerable in practice is that counterfeiting a signature is a felony which can have dire judicial consequences; and since such signatures occur in the mundane physical world, witnesses and other incriminating evidence are always a possibility looming over the future career of any fraudster. This works, in that it effectively deters signers from defaulting on their actual signatures, even though the pen is, from a cryptographic point of view, a really atrocious protocol. The same concepts can be applied to just about any replacement for that pen, even a Web browser in a tablet.