3

There is a number of services online like RightSignature or SignHub that will let you sign online legally binding documents. I understand how documents can be signed digitally and this can guarantee that they were not altered, but I do not understand how they can guarantee non-repudiation. For example, I just created an account for John Doe and all information I had to provide was an email. As you can imagine, my name is not John Doe. What is to prevent an interested party to create a fake account for the other party and sign the document in his name? I guess I am missing something simple here :)

So, how these documents signed online can be legally binding when no one checked my identity?

Improve this question
3

Legal matters depend on jurisdiction, and there are a lot of those. However, in many of them, a signature is "legally-binding" if the signer really did it. When you sign, how you do it does not matter as far as legal binding is defined; putting your name at the end of an email is also a legally binding signature. Several cases have shown that an oral agreement with a handshake in Hollywood can also be legally binding.

The methods used to produce the signature matter not for defining whether the signature is legally binding, but for proving it. Roughly put, in case of contest, the purported signer will claim that he did not do it, while his opponent will be intent on demonstrating that he is a filthy liar and indeed "signed" whatever document is at the heart of the dispute. Depending on the technical details of the signature mechanism, judges will then consider that the burden of proof lies on the party who claims the signature validity, or on the party who disputes it, or somewhere in between.

In France, there is a (relatively new) notion of signature qualifiée, meaning that a system has been audited and certified and exhibits sufficiently robust security qualities (including use of asymmetric cryptography, but also appropriate authentication mechanisms for certificate issuance and similar things) that the burden of proof automatically lies on whoever claims that the signature is fake -- he may still win, but he will have to work it through.

None of this is really new; after all, we have long been "signing" documents by dropping ink smudges on paper, and these have been known for centuries to be relatively easy to counterfeit. What makes paper signatures tolerable in practice is that counterfeiting a signature is a felony which can have dire judicial consequences; and since such signatures occur in the mundane physical world, witnesses and other incriminating evidence are always a possibility looming over the future career of any fraudster. This works, in that it effectively deters signers from defaulting on their actual signatures, even though the pen is, from a cryptographic point of view, a really atrocious protocol. The same concepts can be applied to just about any replacement for that pen, even a Web browser in a tablet.

Improve this answer
4
  • +1 - spot on. Non-repudiation in its naïve form is an anti-feature. In any functioning system, it must be possible to repudiate a signature which is not genuine. In reality this means a detailed audit trail. For online document services, this is in the web server logs, IP addresses, login used, emailed confirmation links and so forth, together with the fact that they are a third-party witness to all those facts. – Ben Jan 10 '14 at 11:07
  • In my country (Category 1 same as US according to this map echosign.adobe.com/en/misc/international-Esignatures.html), in order for digital signing to be legally binding, I have to provide a digital certificate purchased from a recognized certificate authority. CA will issue me a certificate only after they authenticate me with a photo ID. All services I listed do not perform any kind of authentication. Going back to my question, some of these services will provide layers in case of litigation, but how they hope to win if they do not authenticate parties??? – Dan Jan 10 '14 at 23:50
  • Regarding your handshake example, I'd guess to provide service that claims to be legally binding based on handshakes, you'd have to resort to providing a few witnesses, recording a video etc. that would make plausible demonstrating this in court. – Dan Jan 11 '14 at 0:09
  • @ThomasPornin - hoping you can clear up my confusion. I received an email containing a link to sign a document. I use a no-logging VPN. I copy/paste the link from the mail in my browser and sign the document. How can the service ever proof it was me who signed the document and not some man in the middle? And for that matter, how can "I" proof I signed the document? Is this solely based on the fact that e-mail is considered secure enough and the change of it being someone else is far less then the chance on it being me who signed? – Lieven Keersmaekers Dec 16 '20 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.