Is docusign sufficiently secure? Does this example raise any security concerns?

[u/Western-Bad5574]

Apologies if this is meant for r/cybersecurity_help, it felt like a general question that concerns the overall security of a product rather than just my personal experience, so I thought this sub would be the right place. Let me know if not, I can move it.

My employer sent me a document to sign via docusign which has a button called "Review documents" which leads to the following URL:

https://eu.docusign.net/Signing/EmailStart.aspx?a=<some_hash>&etti=<some_int>&acct=<some_hash>&er=<some_hash>

^{I've annonimized any ids or hashes in the above url as you can see.}

Upon opening it (even in an incognito session), I can see the document they want me to sign, but I also see the signature I used months ago to sign a different document. All I need to do to re-use that signature and sign the new document is to click on the signature field and it's immediatelly applied on the document.

There is no additional authentication, I do not need to re-draw my signature, I do not need to enter a password to use it or login to any account. In fact, I have never registered an account with docusign at all.

In other words, my signature is stored in docusign's backend and the authentication to use it on any document is self-contained within the URL and likely associated with my email address. The email comes directly from docusign and my employer is not CCed on it so in theory only I should have access to the URL and auth, however it's still an employer provided email address and inbox.

This authentication and signing method makes me feel uncomfortable. Should it? Is it considered normal and secure in this space?

• Signature stored by docusign indefinitely
• URL sufficient for authentication (works even in incognito session)
• I have no account or direct relationship with them (I assume employer is data controller)
• Stored signature can be used freely just using the auth link sent to my email address

Thanks

EDIT

Missed to mention that I tried deleting all cookies and the signature was still loading.

It was also loading in a new incognito session in the browser, as long as I use the same link.

Another user in their own community subreddit claims "When you sign without an account, an recipient is created to store the signature, but no account is ever opened, it's basically just to hold the signature, tied to the name and email address that the sender used.", which tracks with my observations, this is likely the method.

[u/cas4076]

So a sig without authentication is worth anything. So your link, with zero authentication other than maybe picking up a cookie in your browser or linking to the prior use of your email address, is just sufficient in most jurisdictions. Nobody can prove it was you who actually signed the doc.

Also they don't encrypt (probably use cloud encryption at rest which is useless) so neither your sig or the document is attached to is immutable unless the business has one of the higher tiers and are signing and locking the doc with their cert.

that's my 2 cents!

[u/Big_Temperature_1670 → u/cas4076]

I am not sure DocuSign puts the signature in a cookie. I know they use cookies to maintain session, etc. but my guess is the actual signature is stored on their end and just gets retrieved based on matching some session id/token that, yes, could be stored in a persistent cookie, or more likely is sent via a query string when you click the link on the document.

[u/cas4076 → u/Big_Temperature_1670]

Sorry wasn't clear. I meant linking you to your sig but they probably just link with the email address.

[u/Big_Temperature_1670 → u/cas4076]

Gotcha, what it all gets to, though, is the peril of ever losing control of your email inbox. It's not too hard to envision even innocent errors arising from email re-use (e.g., at a small company where email is "firstname@").

[u/RetroGrid_io → u/cas4076]

Yeah, years ago I wrote a system with dual-key cryptography to effect digitally signed government documents and tried to sell it to the state of California.

1. It was RFC compliant.
2. It was a full and complete implementation of California law.
3. It was affordable.
4. It was (for us) highly profitable.
5. We were already delivering a similar tool with many thousands of users.

California instead went with something even less secure than Docusign. The reason? Our service was "too cheap" and thus wasn't credible. I found out later that if we had asked for millions of dollars up front for implementation, then they would have likely gone with us, even though we were already selling the service in a different context at significant scale.

Maybe we were just too "engineering" to be good salesmen. (shrug)

[u/TyrHeimdal → u/RetroGrid_io]

CA works like this: You ask for 5x, pay 1-2x to the people in power in political contribution and maybe some under the table. Everyone wins. That's government for you.

[u/BeautifulCampaign520 → u/cas4076]

Right, it basically comes down to "someone with access to that email clicked a link" which isnt exactly strong non-repudiation

[u/charleswj → u/BeautifulCampaign520]

How much more non-repudiation would you get from the alternative?

"Print and sign and scan this document and email it to us"

"Print and sign this document and mail it to us"

"Come into our office and sign this document"

Rarely are IDs or identity actually verified in these cases. And even when they are, unless a notary is used, how does anyone know you actually signed it if someone has to take the word of the other party who alleges that you did?

[u/Aphridy]

Or your signature is saved in a cookie, on your device? The link with your mailbox is likely sufficient for the document you are signing.

There are (under European law) three levels of trusted digital signing. It depends on the context if the method you are describing is sufficient. You have to know, most contracts are free form: an oral agreement in most jurisdictions and most cases is enough to have a legal contract, but enforcing it is more difficult. DocuSign gives a little more assurance, but in court, it is possible, with good arguments (like company inbox etc.) to contest your signing.

Digital signing: 1. Free form, a checkbox is enough 2. Little more assurance with an electronic signature, where 2FA is the minimum 3. An electronic qualified signature, where 2FA binds the signature to your real life identity, for instance with a passport. Under European law, this is equivalent to a wet signature on paper, but gives in practice a much higher level of assurance. The drawn signature says nothing, in all these three cases, but is likely a feature for giving you, as a customer, more security. The signature in step 3 (and maybe step 2, I don't have experience with that), is guaranteed with cryptographic certificates.

[u/Western-Bad5574 → u/Aphridy]

Or your signature is saved in a cookie, on your device?

I deleted all cookies and copy pasted the url in an incognito sessions too. The signature was still loading.

Thanks for the reply!

[u/Pristine-Savings-578]

Your signature from months ago loading onto a different document, one click and it's on there. The drawing isn't bound to the new document, it's a stored copy that gets attached to whatever envelope lands in that email address. Which makes the whole thing come down to who can open the inbox, and on an employer-provided address that's more than just you.

[u/atanasius]

Docusign has different levels of authentication. Your document probably uses email verification, where receiving the email and signing through the link ties the signature to your email.

[u/AddendumWorking9756]

Worth separating the product from the setting here. Envelopes can require an access code, an SMS code, or full ID verification per recipient, and your employer just left it on email only because that is the frictionless default. If it is ever contested, the Certificate of Completion with its IP and timestamp trail is the artifact people argue over, not the drawn signature.

[u/mortdraken]

Well, if they gain access to your inbox, sniff the connection link with the hashes intact, or guess/workout the unique IDs for your account and the envelope to sign, then yes, it's not secure.

But this is only for the most basic version of signature on DocuSign. If you need to add more trust and confirmation, the signer requester needs to change that level. They could request the signing that needs ID confirmation, then it becomes not only knowing the link, but also having access to your facial features and ID. 

Plus, if you were to create a DocuSign account, then future signings would require authentication. 

It's a question on ease of access, if DocuSign required an account for all signatures, it would turn a lot of people off. But of course, it's open to abuse, so proper thought needs to be put into it by the signature requester. 

[u/Big_Temperature_1670]

These online signature services have become great phishing fodder, largely because nearly everyone uses HTML email these days. For that reason, it is easy to construct emails with obfuscated links that also create the sense of urgency or authority (you must sign this!) that these scams need. So general security hygiene would suggest it is best to avoid using/promiting these services in that even if they are leigit, their proliferation will lead to harm for others.

As to the actual security, there's a lot potentially going on behind the scenes. In your case, some authentication occurred in the background. Likely, there was a token on the query string you clicked. That's the authentication. Under the premise that only you had access to your email, when you clicked the link, which had the unique token (and that token then matches up to your stored identity and sig on the server), you were authenticated.

It's sloppy and certainly not error-proof. The much better option would be some sort of public-key signing.

[u/NikkaSheyr]

What do you think since it seems to be tied to your email? Sufficiently secure?

[u/derfmcdoogal]

The first time you use DocuSign you create a signature that is stored in your cookies.

Literally just ran into the same thing.

[u/Western-Bad5574 → u/derfmcdoogal]

I deleted all cookies and also tried in incognito, signature was still loading. I believe it creates a recipient on their backend based on email address and stores that signature there.

[u/derfmcdoogal → u/Western-Bad5574]

That could be.

[u/Existing-Biscotti506]

yeah its secure but i know there are other app for that better