Any selfhosted alternative for docusign ? reddit / selfhosted ---------------------------------------------------------------------- labm0nkeys · 2023-10-12 13:21 Was looking for some recently. I like this one https://www.docuseal.co/ ---------------------------------------------------------------------- karthiceaswar · 2023-10-12 13:42 Yup, saw that. Seems like this is only the majorly known alternative it seems. ---------------------------------------------------------------------- pathartl · 2023-10-12 14:36 I don't understand the pricing here. We sign about 15k documents a year and the cheapest price I could find was by basically rolling our own solution and it would have ended up at 75c/doc. How can DocuSeal do it for free? ---------------------------------------------------------------------- kn33 · 2023-10-12 14:43 I'm gonna be honest. When it comes down to it, I trust a court to accept a signature on a commercial product like docusign more than they'd trust something I self-hosted, and what a court will trust is what matters. I don't necessarily agree that the commercial product is more trustworthy, but if the point is to be able to prove it then you gotta be able to provide the proof that the judge will accept. ---------------------------------------------------------------------- ervwalter · 2023-10-12 14:50 They give away their free tier and you pay if you want more features: [https://www.docuseal.co/pricing](https://www.docuseal.co/pricing). They count on large companies wanting the more advanced features. ---------------------------------------------------------------------- schklom · 2023-10-12 14:56 From what i read (feel free to tell me i'm wrong if i am), all these software do is let you generate a private key and digitally sign documents with it. Using one software or another should not make much difference https://en.wikipedia.org/wiki/Digital_signature ---------------------------------------------------------------------- kn33 · 2023-10-12 15:04 Docusign is much more based on using a hand-drawn signature, and coordinating corroborating information about the environment when the signature is taken to authenticate it. This would be IP, user agent, location (if permissions are granted), and any other info that contributes to fingerprinting. (see https://fingerprint.com/demo/ for more) ---------------------------------------------------------------------- Dry_Doctor_5658 · 2023-10-12 15:25 I've not tried it, but I just found [libresign](https://libresign.github.io/) which can be used in nextcloud. ---------------------------------------------------------------------- schklom · 2023-10-12 15:40 My experience with this is with Acrobat Reader, which does not require Internet. How does fingerprinting works with digital signatures if Internet is not even needed? My understanding is that it simply appends a hash of the document (sometimes it also adds a picture of a hand-drawn signature and maybe a timestamp before hashing) to the document. Where does fingerprinting come into this? ---------------------------------------------------------------------- kn33 · 2023-10-12 15:44 > How does fingerprinting works with digital signatures if Internet is not even needed? Internet is required for docusign unless you're using their mobile app, in which case the fingerprinting is provided by the app itself. ---------------------------------------------------------------------- giezen · 2023-10-12 16:29 Take a look at this collection: https://www.dodlr.com/list/electronic-document-signing-platforms- fbQYcR/ ---------------------------------------------------------------------- BleepsSweepsNCreeps · 2023-10-12 16:42 One I noticed that wasn't on the list was LibreSign. I haven't used it yet. I know you can download it as a Nextcloud app if you run NC and I'm fairly certain it can run on its own as well. Might be worth looking into ---------------------------------------------------------------------- nemec · 2023-10-12 16:47 Yep, Docusign is not *really* solving a technical problem so no selfhosted technical solution will replicate it. They're solving a trust problem between people and using technology to do it. ---------------------------------------------------------------------- thcduck · 2023-10-12 17:18 Correct me if I'm wrong, but I've been working with digital signatures for some time now and it seems that what really matters is the certificate itself, so if I use DocuSign with their certificates or if I use a personal/enterprise A3 certificate (issued by a certified CA) it would be the same regarding trust. Also, don't know about [DocuSeal](https://www.docuseal.co/), I'll spin it up to see what it does. ---------------------------------------------------------------------- atheken · 2023-10-12 17:29 I agree, but there is an actual argument here that Docusign is an independent body that is incentivized to prevent forgery. I’m also 100% sure they’re paying for external audits of their system (not perfect, but also not something a typical self-hoster would be doing). Also, it was referenced below, but docusign has nothing to do with PKI, and more to do with all the external information and verification that is collected during the signing process that provided reasonable assurance that: - the identity of the signer was verified during the process of signing. - the signer took an affirmative action (i.e. clicking “sign”) If one were to self-hosting a docusign clone, there’s incentive and opportunity to forge, less clear methods of verification (if any), and a higher potential for data loss. People think contracts are some kind of magical paper that becomes ironclad and indestructible once they’re executed, but it relies heavily on the parties involved and the trustworthiness of the process. I also think that if the general public had a better concept of how PKI works, and could establish their public key as part of their identity (as in, possibly have the public key notarized), there would be some cool (and better) ways to sign documents without intermediaries. ---------------------------------------------------------------------- atheken · 2023-10-12 17:33 Docusign really has nothing to do with PKI. If we had trusted registries of public keys, we wouldn’t need docusign, but then you get into the question of what makes a registry “trustworthy” and the definition of “sign.” ---------------------------------------------------------------------- kn33 · 2023-10-12 17:36 I agree with all of this. In retrospect, I probably wouldn't include "I don't necessarily agree that the commercial product is more trustworthy" in my other comment. When it comes down to it, docusign is incentivized by profit. If their (valid) signatures aren't held up in court, their reputation goes down the drain. They'd stop getting customers, and existing customers would leave. That incentivizes them to make the signatures they collect trustworthy, which is the point of this type of software. ---------------------------------------------------------------------- SirEDCaLot · 2023-10-12 17:39 I'll be totally honest- I don't think there could be, except within an organization. The whole point of contracts is to create terms that will hold up in court. So if the court doesn't recognize a signature, you might as well not have one. Docusign can be referred to as a *trusted third party*- that is, both parties to the contract trust DocuSign. So I upload my contract and pay DocuSign to send it to the other guy, he signs it, and I trust that DocuSign is doing some basic reasonable security verification of his connection. And a court will accept that DocuSigned contract as 'signed'. OTOH let's say I roll something myself. This is now a conflict of interest- I'm both the one hosting the signature system, AND one of the parties to the contract. I can show the court the 'signed contract', but if the other guy wants to weasel out he'd just argue that the 'signature' is on my system with logs I provide that I could have just as easily faked. Now the signature itself is in question. ---------------------------------------------------------------------- atheken · 2023-10-12 19:12 For sure, I mainly just figured I'd mention it, because sometimes people don't understand the value-prop on these kinds of products and think that self-hosting a clone is 1:1 replacement when the actual value is less about the software you can see, and more about the process that you can't. ---------------------------------------------------------------------- metaidentity · 2023-10-12 19:32 Uh.. blockchain alternatives, maybe? ---------------------------------------------------------------------- bendem · 2023-10-12 20:02 Yay Europe and eIDs. Everybody has a personal smart card to sign documents using public standards. ---------------------------------------------------------------------- neptrio · 2023-10-12 20:50 [https://github.com/documenso/documenso](https://github.com/documenso/ documenso) ---------------------------------------------------------------------- arienh4 · 2023-10-12 21:06 DocuSign is not about digital signatures in the cryptographic sense. It's just a legal signature that happens to be provided electronically rather than on paper. In principle, depending on the jurisdiction, you can use PKI to produce legal documents too, but that's pretty rare. ---------------------------------------------------------------------- LiPolymer · 2023-10-12 21:17 The whole concept is weird though. As someone signing the document via DocuSign, I don’t have to provide any form of verification. I need to have the link and that’s it. I literally just have to click a few times. Not even a mouse-drawn signature is required, or an account or anything. How is that legally binding to anyone? My dog could have signed that document on accident! ---------------------------------------------------------------------- LiPolymer · 2023-10-12 21:19 Or PGP for that matter, associated with an email address uploaded to a key server. Don’t quote me on how that holds up in court though. IANAL ---------------------------------------------------------------------- user01401 · 2023-10-12 22:27 https://www.reddit.com/r/opensource/comments/13u2rhs/open_source_docus ign/ ---------------------------------------------------------------------- Craneson · 2023-10-12 22:42 The sender can request additional security measures, like a validated account, a confirmed form of ID and so on. Also DocuSign saves every single detail of the signing process (IP, geo location, browser, user agent, etc.) In theory you could still argue you didn't sign it, but that's the same with every contract you sign: "that's not my signature". If you want to go down that hole: even just verbal contracts are binding without any documents or witnesses. ---------------------------------------------------------------------- AnomalyNexus · 2023-10-12 23:17 No - because it is not a technical problem at all & that is missing the point entirely. I routinely deal with 70 year old directors on various corporates boards. They all understand docusign. Everyone trust it. Everyone accepts it. Everyone understands it. Nobody goes...well I'd like a solution nobody casual trusts, nobody has heard of and nobody understands...but it is selfhosted so it's better. Much like selfhosted email...it's not a technical issue, it's about trust. ---------------------------------------------------------------------- IntrovertedFL · 2023-10-13 02:13 Thanks for sharing that :) ---------------------------------------------------------------------- Raah1911 · 2023-10-13 02:25 I mean at that point a picture of your signature on a word doc is about as useful. ---------------------------------------------------------------------- CeeMX · 2023-10-13 06:44 The issue with that (or basically every open source solution) is the certificate not being in the AATL (Adobe Approved Trust List), what makes the Signature not show as green in Adobe reader. Certificates you can buy for signing seem to come on a usb token and I don’t know if it’s possible to integrate that in docuseal ---------------------------------------------------------------------- CeeMX · 2023-10-13 06:47 There is a trusted registry, it’s Adobe’s AATL. Basically the same concept as trusted CA in browsers ---------------------------------------------------------------------- CeeMX · 2023-10-13 06:50 In theory. But sadly that’s not a thing right now, or I haven’t found out how to do it ---------------------------------------------------------------------- bendem · 2023-10-13 07:44 I work in Belgium and these are called qualified signatures, they are used everywhere and count as handwritten signatures in front of a court. ---------------------------------------------------------------------- ozzeruk82 · 2023-10-13 07:58 You're absolutely right, the process could be a million times more secure but it isn't. I 'signed' some documents earlier in the year related to a house sale and I was staggered by how people appear to have no clue how this works, and how it's effectively no better than clicking a link where your IP address is stored. I was expecting to be able to use a public/private key pair, third party verification etc... nope. Nothing. If you ask me the industry is effectively a scam. The reason I say that is that my realtor was saying "yes, digitally sign it, it's extremely secure and uses encryption and stuff". So "non-tech" people are absolutely convinced that "top level encryption/security" comes as standard with these "digital signing platforms". It doesn't unless it's specifically setup, which typically I've found it isn't. ---------------------------------------------------------------------- ozzeruk82 · 2023-10-13 08:01 That would be great if the technology was actually used. Europe here and when dealing with a house sale, various documents were "signed" by just scribbling a 'signature' and clicking a link. Such a wasted opportunity. ---------------------------------------------------------------------- LiPolymer · 2023-10-13 08:03 Yeah, that’s how I see it, too. It is complex enough so that the average person doesn’t understand it, and it adds cool random numbers to your document that look secure, so it must be fine! I’d be really interested if this actually holds up in court. But, like others have said, a physical signature probably isn’t much more secure either. It just feels like such a waste. After all, we do have the technology, why not just use it? ---------------------------------------------------------------------- CeeMX · 2023-10-13 08:03 Qualified electronic signatures (QES) are a signature level of the eIDAS standard on EU level. But this only means that you have verified that you are the actual person doing the signature. That is usually done by Video Ident or login with the electronic ID card. Also every signature needs second factor auth. But the actual signing is not done by the cert on the card (maybe it is in Belgium though, in Germany it’s not possible yet as far as I know) ---------------------------------------------------------------------- eRIZpl · 2023-10-13 08:17 Sometimes an ability to confirm exact timestamp in a trustworthy way is the most important thing. ---------------------------------------------------------------------- bendem · 2023-10-13 08:19 That's not how it works. Since eIDs are smartcards and they are all delivered by the national CA (this is pki with national services as the root CA), the fact that you were able to sign the document with it already proves who you are, no further verification needed. I should know, that's my job. ---------------------------------------------------------------------- I-Made-You-Read-This · 2023-10-13 09:58 In Switzerland there are services to have a qualified electronic signature under your control. It’s quite expensive to run it all yourself, you need an HSM and all that. But it’s trusted in court because your certificate is signed by a trusted CA. check if there is something similar in your country. You don’t always need a cloud solution ---------------------------------------------------------------------- atheken · 2023-10-13 10:58 Well, that goes to my last point, what makes it “trustworthy”? It’s not enough to just be a central repository for public keys, it needs to be verifiably linked to an entity in a way that is recognized by all parties involved. This usually takes the form of government issued ids. It’s not a technically tricky problem, is socially tricky. ---------------------------------------------------------------------- CeeMX · 2023-10-13 11:01 Yea, it’s the same problem we have with HTTPS trusted CA, if they go rogue or issue certificates without checks (see Symantec some years ago) it’s bad. ---------------------------------------------------------------------- thcduck · 2023-10-13 14:18 I guess I'm missing something then, what do you mean by "signatures in the cryptographic sense"? All I searched about signatures was for company documents, and for us it's enough to sign with a valid A3 certificate with a timestamp for legal stuff as long as it ticks every box on Adobe Reader. ---------------------------------------------------------------------- arienh4 · 2023-10-13 14:41 The part where you're talking about certificates. DocuSign's product is basically just an audit log. They allow you to prove that this person, as identified in this manner, clicked "I agree" for this document. The fact that DocuSign _says_ that happened is what has legal value. It has absolutely nothing to do with the technology you're talking about, where someone signs a document using the private key associated with a certain certificate that is itself signed by a CA. As I said, that happens, but it's not common. ---------------------------------------------------------------------- skyrunner15 · 2023-10-13 15:26 Docuseal ---------------------------------------------------------------------- marcuswquinn · 2023-10-14 03:13 Docuseal is now an app on Cloudron, too https://forum.cloudron.io/topic/9677/docuseal-docusign-alternative ---------------------------------------------------------------------- Tim-Fra · 2023-10-14 18:47 Nextcloud & cerificate24 https://www.certificate24.com/ ---------------------------------------------------------------------- Tim-Fra · 2023-10-14 18:47 Or libresign ---------------------------------------------------------------------- anarchysoft · 2023-10-16 15:20 yes, it exists. but people are still stupid. ---------------------------------------------------------------------- kn33 · 2023-10-16 16:02 > even just verbal contracts are binding without any documents or witnesses. Yeah, it's just impossible to enforce them because one party can lie and there's no proof otherwise.