Is there an alternative (cheap-ish) way to have multiple people sign a document?

December 5, 2007 7:25 AM

Is there an alternative (cheap-ish) way to have multiple people sign a document? I don't think my boss will go for multiple licenses of Acrobat. Any good ideas?

There's no way that my boss will shell out $299 a license for Acrobat Standard.... or for adobe live cycle. I want to reduce the huge piles of paper needed to get confirmations and sign offs on a document that 6-10 people have to sign.

Any ideas that might be open source?

The documents will all be in house and just needs to be secure enough to keep everyone in the office honest about not changing the document and saying that they never approved a change.

Thanks for any help.

posted by pleuroma to computers & internet (10 comments total)

If your documents are generated in MS Office, I believe you already have the capability to do this directly in Word.

Tools>Options>Security>Digital Signatures

Never used it myself, though.
posted by nedpwolf at 8:00 AM on December 5, 2007

You could use source control, say subversion, check out the doc if you want to change it.
posted by zeoslap at 8:12 AM on December 5, 2007

You could do this through a CMS, like, say, Drupal. Generate your file and upload it as a new entry, or paste the text of it in. Have each person whose sign-off you need log in under their own account and add a comment along the lines of "I have read and approve this document."

The key is in the permissions. If you make it so that neither the author nor anyone else can edit an entry once it's been posted (and this is trivial to do), they can't make silent changes. With Drupal at least, there are also ways to track revisions to node content, so that changes could be made, but would not be silent.
posted by adamrice at 8:33 AM on December 5, 2007

If you have a Windows 2003 server, you can do this easily in Sharepoint Services. There's a canned workflow that allows you to collect signatures on a document.
There's no cost for Sharepoint Services as long as you have a Windows Server license.
You can upload any type of document.
posted by Eddie Mars at 8:45 AM on December 5, 2007

maybe try DocuSign?
posted by hummercash at 9:02 AM on December 5, 2007

just a followup link to DocuSign... this article on TechCrunch is where I first heard about it. they provide a nice description and a few alternatives as well in the article.
posted by hummercash at 9:07 AM on December 5, 2007

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Digital signatures or a hash algorithm with a secret.

Essentially, use something that can take something and create a checksum. The checksum can't be used to go backwards, checksum -> secret.

So, take "public text" add a secret "secret phrase" and run that through something like SHA512, to get a number. Publish the resulting number.

At any time, one can prove to oneself that "public text" hasn't changed, because one can recompute the number and get the same result, and unless someone knows the secret, they can't create the same checksum even for checking.

- ---

If you want to be able to prove to other people that something is signed, without needing the consent of the signer to check it, then you need a asymmetric key system. You make a pair of keys, one of which is secret and one is public. A signer computes a number based on the "public text" and the secret part of the key. Anyone can verify (but not reproduce!) the secret-key owner signed the document.

This entry is provably signed, e.g., using GnuPG. Of course, this key is generated just now and you don't have the public part, so verifying its authenticity doesn't work until you know me, but it's just an example. Note the text at the bottom.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHVt6pdEVSiX2Pdn8RAh3iAJ4s8ZKh4WAjtcERD/grk2wEvxFHJQCfQWBF
Q2Oj1oOH95KiHmkbdensLtc=
=hiOa
-----END PGP SIGNATURE-----
posted by cmiller at 9:24 AM on December 5, 2007

If the document is intended to have some binding legal effect, like a confirmation that someone agrees to certain terms or that they received certain information, for example, I would recommend that you talk to your company's counsel and find out if they would prefer an actual hard copy signature to a digital signature anyway. I know I would.
posted by The World Famous at 9:26 AM on December 5, 2007

I failed to mention, because I thought it would be obvious, but in case it's not: If anything about the enclosing text is changed, then the signature at the bottom no longer verifies it. You can't sneak any changes in without someone being able to notice.
posted by cmiller at 9:28 AM on December 5, 2007

Does anybody there have Acrobat Pro? You only need one copy to create pdfs that anyone with Reader can sign.
Enable Adobe Reader† users to digitally sign PDF documents
posted by dpcoffin at 11:27 AM on December 5, 2007