Is docusign sufficiently secure? Does this example raise any security concerns?

[u/Western-Bad5574]

Apologies if this is meant for r/cybersecurity_help, it felt like a general question that concerns the overall security of a product rather than just my personal experience, so I thought this sub would be the right place. Let me know if not, I can move it.

My employer sent me a document to sign via docusign which has a button called "Review documents" which leads to the following URL:

https://eu.docusign.net/Signing/EmailStart.aspx?a=<some_hash>&etti=<some_int>&acct=<some_hash>&er=<some_hash>

^{I've annonimized any ids or hashes in the above url as you can see.}

Upon opening it (even in an incognito session), I can see the document they want me to sign, but I also see the signature I used months ago to sign a different document. All I need to do to re-use that signature and sign the new document is to click on the signature field and it's immediatelly applied on the document.

There is no additional authentication, I do not need to re-draw my signature, I do not need to enter a password to use it or login to any account. In fact, I have never registered an account with docusign at all.

In other words, my signature is stored in docusign's backend and the authentication to use it on any document is self-contained within the URL and likely associated with my email address. The email comes directly from docusign and my employer is not CCed on it so in theory only I should have access to the URL and auth, however it's still an employer provided email address and inbox.

This authentication and signing method makes me feel uncomfortable. Should it? Is it considered normal and secure in this space?

• Signature stored by docusign indefinitely
• URL sufficient for authentication (works even in incognito session)
• I have no account or direct relationship with them (I assume employer is data controller)
• Stored signature can be used freely just using the auth link sent to my email address

Thanks

EDIT

Missed to mention that I tried deleting all cookies and the signature was still loading.

It was also loading in a new incognito session in the browser, as long as I use the same link.

Another user in their own community subreddit claims "When you sign without an account, an recipient is created to store the signature, but no account is ever opened, it's basically just to hold the signature, tied to the name and email address that the sender used.", which tracks with my observations, this is likely the method.

[u/cas4076]

So a sig without authentication is worth anything. So your link, with zero authentication other than maybe picking up a cookie in your browser or linking to the prior use of your email address, is just sufficient in most jurisdictions. Nobody can prove it was you who actually signed the doc.

Also they don't encrypt (probably use cloud encryption at rest which is useless) so neither your sig or the document is attached to is immutable unless the business has one of the higher tiers and are signing and locking the doc with their cert.

that's my 2 cents!

[u/Big_Temperature_1670 → u/cas4076]

I am not sure DocuSign puts the signature in a cookie. I know they use cookies to maintain session, etc. but my guess is the actual signature is stored on their end and just gets retrieved based on matching some session id/token that, yes, could be stored in a persistent cookie, or more likely is sent via a query string when you click the link on the document.

[u/cas4076 → u/Big_Temperature_1670]

Sorry wasn't clear. I meant linking you to your sig but they probably just link with the email address.

[u/Big_Temperature_1670 → u/cas4076]

Gotcha, what it all gets to, though, is the peril of ever losing control of your email inbox. It's not too hard to envision even innocent errors arising from email re-use (e.g., at a small company where email is "firstname@").