Additional security to Box Sign links in "completed" emails
Box Sign sends an email to a signer (subject "Completed: [name of document]") after all the documents have been signed. This link gives anyone with the link access to the document in question with no additional authentication (e.g. MFA, password, Box login) needed. This link skips folder or Box Shield settings restricting the use of shared links and cannot be manually removed or expired. Email, without any additional protections, is not considered secure enough for transmittal of certain types of protected information (e.g. patient health information under HIPAA). A bad actor who grabs this post-signing email from a patient who signed a form could use the link to access that patient's health information. Therefore Box Sign in it's current state cannot be used with any forms that ask for this kind of sensitive data. I would request an ability to turn off these post-signing links.
Anonymous
shared this idea
-
Mia S.
commented
I'm surprised such a significant security gap has so few votes.
My firm was ready to adopt Box Sign (moving from Docusign), and this issue ended up being a dealbreaker for us. Sensitive documents should not be accessible through public links, especially when those links cannot be expired, revoked, or governed. Our signers reported they did not feel safe using this platform, so we had to switch back at a significant cost to us.
The article linked by Shawn only addresses security controls involved in signing the document in the first place. Such controls do not apply to the completed-document links sent after signing, which is the actual issue.
When reaching out directly, the workaround proposed to us by Box was to suppress all Box Sign notifications through the API and rebuild the entire notification process ourselves. That is not a realistic solution for most customers and is quite redundant.
Until administrators have the ability to control or disable these links, this will remain a significant barrier to adoption for organizations with strong security and compliance requirements. If Box Sign intends to compete as an enterprise-grade platform, this should be a top product priority.
-
Anonymous
commented
I agree. I believe that BoxSign has issues that could lead to information leaks due to its lack of control functions.
At the very least, we request that the following functions be implemented as soon as possible: preventing the sending of BoxSign link emails, preventing the issuance of open links (making them operable only from the Sign folder), etc. -
Ryan Ohlson
commented
While Box Sign allows you to secure a document when sending it for signature (SMS, Password), the document is viewable without the SMS or Password once it is signed. Box Sign automatically sends an email to all parties confirming the completion of the signing process. In that email the link to the completed document is not protected by the same measures as when it was first sent for signature.
In many cases, the document that is being signed contains extremely sensitive information and thus it is best practice for the document to be protected with the additional layer of authentication even after it is signed.
Currently, the only way to manage this is for the Box Sign owner to locate the completed files and either remove the Shared Link that Box Sign automatically created or to manually enable a password for the link.
-
Box Sign provides additional security by allowing recipients to be modified to add functionality such as passwords, require box login and require 2FA. More information can be found here:
https://support.box.com/hc/en-us/articles/4406861109907-Additional-Signer-Authentication
