Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-29 Thread Niphlod
again, I'm lost. Either you need to comply with some kind of standard AND 
the signature you're going to calculate is supposed to be verified by some 
external service. or as you placed your requirements the need for a 
PKI is extremely overkill.

BTW: maintaining your own PKI (in the right way) requires a HARD 
knowledge of security-related arguments. it's easy to fall in errors that 
results in your app being less secure than a simple hash.

-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-29 Thread Richard Vézina
Anyone ever use OPENXKPI : https://github.com/openxpki/openxpki

?

Richard

On Wed, Apr 29, 2015 at 11:16 AM, Richard Vézina 
ml.richard.vez...@gmail.com wrote:

 Turns out that I need a PKI for meet requirement... HMAC with password can
 help but it not an electronic signature just part of the design depend of
 the design...

 :(

 Richard

 On Tue, Apr 28, 2015 at 8:58 PM, Derek sp1d...@gmail.com wrote:

 that would do it... but only the user could check the validity.


 On Tuesday, April 28, 2015 at 3:19:03 PM UTC-7, Niphlod wrote:

 I meant an hmac with the user supplying the key, of course. That puts
 you on the safe-side of db admin tampering.

 On Tuesday, April 28, 2015 at 11:32:47 PM UTC+2, Derek wrote:

 I'd have to agree, put the user account (email, username, whatever) and
 the fields all together, calculate hmac on that, and store it. If someone
 changes the data, the hmac won't match and you'll see it's not valid. Of
 course, an admin could just go in and modify the hmac signature after
 updating the record... so you aren't protecting yourself from a malicious
 administrator with the hmac case.

  --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google Groups
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to web2py+unsubscr...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.




-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-29 Thread Richard Vézina
Turns out that I need a PKI for meet requirement... HMAC with password can
help but it not an electronic signature just part of the design depend of
the design...

:(

Richard

On Tue, Apr 28, 2015 at 8:58 PM, Derek sp1d...@gmail.com wrote:

 that would do it... but only the user could check the validity.


 On Tuesday, April 28, 2015 at 3:19:03 PM UTC-7, Niphlod wrote:

 I meant an hmac with the user supplying the key, of course. That puts you
 on the safe-side of db admin tampering.

 On Tuesday, April 28, 2015 at 11:32:47 PM UTC+2, Derek wrote:

 I'd have to agree, put the user account (email, username, whatever) and
 the fields all together, calculate hmac on that, and store it. If someone
 changes the data, the hmac won't match and you'll see it's not valid. Of
 course, an admin could just go in and modify the hmac signature after
 updating the record... so you aren't protecting yourself from a malicious
 administrator with the hmac case.

  --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google Groups
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to web2py+unsubscr...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.


-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Richard Vézina
Interresting... But for signing a DB record really??

On Mon, Apr 27, 2015 at 11:48 PM, Dave S snidely@gmail.com wrote:



 On Monday, April 27, 2015 at 4:56:47 PM UTC-7, Richard wrote:

 Hello,

 I would like to know if anyone had developed any kind of electronic
 signature involving some record signature or encryption inside a web2py app?



 Not an answer, but with all the ads on the radio for CudaSign, I was
 wondering how we would handle e-signing.
 CudaSign, formerly SignNow, is from Barracuda Networks.
 URL:https://www.cudasign.com/

 Barracuda Networks advertises on radio (at least in LA), especially during
 sports broadcasts like Kings Hockey games, Angels Baseball games, and the
 like.  They must figure that a lot SMB IT people listen to those games.
 (SMB IT people seems to include a lot of startup people having to develop
 products and run the company computers at the same time.)

 /dps





 --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google Groups
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to web2py+unsubscr...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.


-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Richard Vézina
You are right Simone and I am glad to have your input. But it prevent at
least that admin of the DB can change data without the user to know and the
review process can't be repudiate...

Richard

On Tue, Apr 28, 2015 at 3:57 PM, Niphlod niph...@gmail.com wrote:

 not to discredit the efforts, but if you're not going to relinquish the
 computed signature to the user, what good does it make over auditing
 changes through, e.g., record_versioning ?
 If the database is only accessed within your app, your app (and/or your
 server) is responsibile of NOT tampering the data. Storing an autocomputed
 hash or signage of whatever kind along the row IMHO has absolutely no added
 benefits, unless the database is accessed by something else than your app.

 On Tuesday, April 28, 2015 at 9:43:26 PM UTC+2, Richard wrote:

 Thanks for answer...

 I want an electronic signature for db records which will be privatekey
 sign by the user when he do some operation (let say review the record
 data). The signature will be done over an serialized version of the record
 once form accepted and before the record get insert. This signature will be
 store in a separate column. It can then be possible by using the user
 pupkey to decrypt the signature to determine what the state of the record
 was and if some tamper with it or not... This process can be automated so
 we don't have to make any visual kind of inspection obviously...

 I start to have pretty good understanding of what I need and how to
 acheive it...

 If there is no body done such a thing I will do it...

 I will then make it available to review and comment and it could be
 included in web2py as a contrib or in the core if it juged enough generic
 and util...

 Richard

 On Tue, Apr 28, 2015 at 3:21 PM, Alex Glaros alexg...@gmail.com wrote:

 this is probably not what you're looking for, especially from a newbie
 like me, but am writing authorizing feature where any number of people can
 be selected to authorize any thing. Example, the organization wants legal
 department, exec, and public affairs department all to authorize a new web
 page before it goes public.

 the way I'm writing it is to use web2py's groups/permissions. Then for
 each authorizable object, user can choose single or two factor
 authorization using Web2py's capability to email user a link proving that
 they authorized that stage of the project.

 Alex Glaros

 --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google
 Groups web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send
 an email to web2py+un...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.


  --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google Groups
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to web2py+unsubscr...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.


-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Derek
that would do it... but only the user could check the validity.

On Tuesday, April 28, 2015 at 3:19:03 PM UTC-7, Niphlod wrote:

 I meant an hmac with the user supplying the key, of course. That puts you 
 on the safe-side of db admin tampering.

 On Tuesday, April 28, 2015 at 11:32:47 PM UTC+2, Derek wrote:

 I'd have to agree, put the user account (email, username, whatever) and 
 the fields all together, calculate hmac on that, and store it. If someone 
 changes the data, the hmac won't match and you'll see it's not valid. Of 
 course, an admin could just go in and modify the hmac signature after 
 updating the record... so you aren't protecting yourself from a malicious 
 administrator with the hmac case.



-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Niphlod
The assumption was indeed if the app is the only thing accessing the 
database. Not trusting DB administrators is kinda weird as a requirement, 
but if that's your scenario, go for it. 
I'm a bit lost on the general idea for the implementation is the 
user required to input some kind of key/cert every time a row is stored ? 
because if you save the key/cert in the db, you're screwed anyway.

-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Niphlod
at this point, why do you even care of using certs ? you need signing, 
not encryption AND you're not hooked up to a CA .just use an hmac 
!

On Tuesday, April 28, 2015 at 10:31:41 PM UTC+2, Richard wrote:

 If the private key is protect by password only the user can use no?

 I am far from an expert in encryption... I was thinking of sotring gpg pub 
 and private key in auth_user field for each respectively. Then invoque the 
 user to input password when he want to sign a record after_validation and 
 before_insert occur...

 ??

 Richard


 On Tue, Apr 28, 2015 at 4:26 PM, Niphlod nip...@gmail.com javascript: 
 wrote:

 The assumption was indeed if the app is the only thing accessing the 
 database. Not trusting DB administrators is kinda weird as a requirement, 
 but if that's your scenario, go for it. 
 I'm a bit lost on the general idea for the implementation is the 
 user required to input some kind of key/cert every time a row is stored ? 
 because if you save the key/cert in the db, you're screwed anyway.

  -- 
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 --- 
 You received this message because you are subscribed to the Google Groups 
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an 
 email to web2py+un...@googlegroups.com javascript:.
 For more options, visit https://groups.google.com/d/optout.




-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Derek
I'd have to agree, put the user account (email, username, whatever) and the 
fields all together, calculate hmac on that, and store it. If someone 
changes the data, the hmac won't match and you'll see it's not valid. Of 
course, an admin could just go in and modify the hmac signature after 
updating the record... so you aren't protecting yourself from a malicious 
administrator with the hmac case.

On Tuesday, April 28, 2015 at 1:43:29 PM UTC-7, Niphlod wrote:

 at this point, why do you even care of using certs ? you need signing, 
 not encryption AND you're not hooked up to a CA .just use an hmac 
 !

 On Tuesday, April 28, 2015 at 10:31:41 PM UTC+2, Richard wrote:

 If the private key is protect by password only the user can use no?

 I am far from an expert in encryption... I was thinking of sotring gpg 
 pub and private key in auth_user field for each respectively. Then invoque 
 the user to input password when he want to sign a record after_validation 
 and before_insert occur...

 ??

 Richard


 On Tue, Apr 28, 2015 at 4:26 PM, Niphlod nip...@gmail.com wrote:

 The assumption was indeed if the app is the only thing accessing the 
 database. Not trusting DB administrators is kinda weird as a requirement, 
 but if that's your scenario, go for it. 
 I'm a bit lost on the general idea for the implementation is the 
 user required to input some kind of key/cert every time a row is stored ? 
 because if you save the key/cert in the db, you're screwed anyway.

  -- 
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 --- 
 You received this message because you are subscribed to the Google 
 Groups web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send 
 an email to web2py+un...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.




-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Richard Vézina
If the private key is protect by password only the user can use no?

I am far from an expert in encryption... I was thinking of sotring gpg pub
and private key in auth_user field for each respectively. Then invoque the
user to input password when he want to sign a record after_validation and
before_insert occur...

??

Richard


On Tue, Apr 28, 2015 at 4:26 PM, Niphlod niph...@gmail.com wrote:

 The assumption was indeed if the app is the only thing accessing the
 database. Not trusting DB administrators is kinda weird as a requirement,
 but if that's your scenario, go for it.
 I'm a bit lost on the general idea for the implementation is the
 user required to input some kind of key/cert every time a row is stored ?
 because if you save the key/cert in the db, you're screwed anyway.

  --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google Groups
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to web2py+unsubscr...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.


-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Richard Vézina
https://www.gnupg.org/gph/en/manual/c481.html#Protecting your private key

Yeah could be kind of weak to store the private key, since it would be only
protect by passphrase but it maybe enough for my need...

I need further reading...

Richard



On Tue, Apr 28, 2015 at 4:31 PM, Richard Vézina ml.richard.vez...@gmail.com
 wrote:

 If the private key is protect by password only the user can use no?

 I am far from an expert in encryption... I was thinking of sotring gpg pub
 and private key in auth_user field for each respectively. Then invoque the
 user to input password when he want to sign a record after_validation and
 before_insert occur...

 ??

 Richard


 On Tue, Apr 28, 2015 at 4:26 PM, Niphlod niph...@gmail.com wrote:

 The assumption was indeed if the app is the only thing accessing the
 database. Not trusting DB administrators is kinda weird as a requirement,
 but if that's your scenario, go for it.
 I'm a bit lost on the general idea for the implementation is the
 user required to input some kind of key/cert every time a row is stored ?
 because if you save the key/cert in the db, you're screwed anyway.

  --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google Groups
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to web2py+unsubscr...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.




-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Niphlod
I meant an hmac with the user supplying the key, of course. That puts you 
on the safe-side of db admin tampering.

On Tuesday, April 28, 2015 at 11:32:47 PM UTC+2, Derek wrote:

 I'd have to agree, put the user account (email, username, whatever) and 
 the fields all together, calculate hmac on that, and store it. If someone 
 changes the data, the hmac won't match and you'll see it's not valid. Of 
 course, an admin could just go in and modify the hmac signature after 
 updating the record... so you aren't protecting yourself from a malicious 
 administrator with the hmac case.



-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Dave S


On Tuesday, April 28, 2015 at 6:46:01 AM UTC-7, Richard wrote:

 Interresting... But for signing a DB record really??


Ah, now you're getting more specific.  You're trying to track who made a 
change (audit function), or to validate that the user is authorized to make 
the change,
or to validate that the change was done without data tampering?


CudaSign is for getting the John Henry of a person attached to an 
electronic document, which may or may not be stored as a database record.  
It presumably covers signing off on such things as contracts, work 
orders, change orders (bill of materials, assembly instructions, other 
manufacturing documentation), and maybe even press releases.  This is 
likely to be important to ERP, content distribution, and sales support.  I 
expect that it reduces the need for faxing in
signatures.


/dps




On Mon, Apr 27, 2015 at 11:48 PM, Dave S snide...@gmail.com javascript: 
 wrote:



 On Monday, April 27, 2015 at 4:56:47 PM UTC-7, Richard wrote:

 Hello,

 I would like to know if anyone had developed any kind of electronic 
 signature involving some record signature or encryption inside a web2py app?



 Not an answer, but with all the ads on the radio for CudaSign, I was 
 wondering how we would handle e-signing.
 CudaSign, formerly SignNow, is from Barracuda Networks.
 URL:https://www.cudasign.com/

 Barracuda Networks advertises on radio (at least in LA), especially 
 during sports broadcasts like Kings Hockey games, Angels Baseball games, 
 and the like.  They must figure that a lot SMB IT people listen to those 
 games.  (SMB IT people seems to include a lot of startup people having to 
 develop products and run the company computers at the same time.)

 /dps



  

 -- 
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 --- 
 You received this message because you are subscribed to the Google Groups 
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an 
 email to web2py+un...@googlegroups.com javascript:.
 For more options, visit https://groups.google.com/d/optout.




-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Richard Vézina
Thanks for answer...

I want an electronic signature for db records which will be privatekey sign
by the user when he do some operation (let say review the record data). The
signature will be done over an serialized version of the record once form
accepted and before the record get insert. This signature will be store in
a separate column. It can then be possible by using the user pupkey to
decrypt the signature to determine what the state of the record was and if
some tamper with it or not... This process can be automated so we don't
have to make any visual kind of inspection obviously...

I start to have pretty good understanding of what I need and how to acheive
it...

If there is no body done such a thing I will do it...

I will then make it available to review and comment and it could be
included in web2py as a contrib or in the core if it juged enough generic
and util...

Richard

On Tue, Apr 28, 2015 at 3:21 PM, Alex Glaros alexgla...@gmail.com wrote:

 this is probably not what you're looking for, especially from a newbie
 like me, but am writing authorizing feature where any number of people can
 be selected to authorize any thing. Example, the organization wants legal
 department, exec, and public affairs department all to authorize a new web
 page before it goes public.

 the way I'm writing it is to use web2py's groups/permissions. Then for
 each authorizable object, user can choose single or two factor
 authorization using Web2py's capability to email user a link proving that
 they authorized that stage of the project.

 Alex Glaros

 --
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 ---
 You received this message because you are subscribed to the Google Groups
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to web2py+unsubscr...@googlegroups.com.
 For more options, visit https://groups.google.com/d/optout.


-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Alex Glaros
this is probably not what you're looking for, especially from a newbie like 
me, but am writing authorizing feature where any number of people can be 
selected to authorize any thing. Example, the organization wants legal 
department, exec, and public affairs department all to authorize a new web 
page before it goes public.

the way I'm writing it is to use web2py's groups/permissions. Then for each 
authorizable object, user can choose single or two factor authorization 
using Web2py's capability to email user a link proving that they authorized 
that stage of the project.

Alex Glaros

-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-28 Thread Niphlod
not to discredit the efforts, but if you're not going to relinquish the 
computed signature to the user, what good does it make over auditing 
changes through, e.g., record_versioning ? 
If the database is only accessed within your app, your app (and/or your 
server) is responsibile of NOT tampering the data. Storing an autocomputed 
hash or signage of whatever kind along the row IMHO has absolutely no added 
benefits, unless the database is accessed by something else than your app.

On Tuesday, April 28, 2015 at 9:43:26 PM UTC+2, Richard wrote:

 Thanks for answer...

 I want an electronic signature for db records which will be privatekey 
 sign by the user when he do some operation (let say review the record 
 data). The signature will be done over an serialized version of the record 
 once form accepted and before the record get insert. This signature will be 
 store in a separate column. It can then be possible by using the user 
 pupkey to decrypt the signature to determine what the state of the record 
 was and if some tamper with it or not... This process can be automated so 
 we don't have to make any visual kind of inspection obviously...

 I start to have pretty good understanding of what I need and how to 
 acheive it...

 If there is no body done such a thing I will do it...

 I will then make it available to review and comment and it could be 
 included in web2py as a contrib or in the core if it juged enough generic 
 and util...

 Richard

 On Tue, Apr 28, 2015 at 3:21 PM, Alex Glaros alexg...@gmail.com 
 javascript: wrote:

 this is probably not what you're looking for, especially from a newbie 
 like me, but am writing authorizing feature where any number of people can 
 be selected to authorize any thing. Example, the organization wants legal 
 department, exec, and public affairs department all to authorize a new web 
 page before it goes public.

 the way I'm writing it is to use web2py's groups/permissions. Then for 
 each authorizable object, user can choose single or two factor 
 authorization using Web2py's capability to email user a link proving that 
 they authorized that stage of the project.

 Alex Glaros

 -- 
 Resources:
 - http://web2py.com
 - http://web2py.com/book (Documentation)
 - http://github.com/web2py/web2py (Source code)
 - https://code.google.com/p/web2py/issues/list (Report Issues)
 --- 
 You received this message because you are subscribed to the Google Groups 
 web2py-users group.
 To unsubscribe from this group and stop receiving emails from it, send an 
 email to web2py+un...@googlegroups.com javascript:.
 For more options, visit https://groups.google.com/d/optout.




-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [web2py] anyone had developed something related to electronic signature in web2py app

2015-04-27 Thread Dave S


On Monday, April 27, 2015 at 4:56:47 PM UTC-7, Richard wrote:

 Hello,

 I would like to know if anyone had developed any kind of electronic 
 signature involving some record signature or encryption inside a web2py app?



Not an answer, but with all the ads on the radio for CudaSign, I was 
wondering how we would handle e-signing.
CudaSign, formerly SignNow, is from Barracuda Networks.
URL:https://www.cudasign.com/

Barracuda Networks advertises on radio (at least in LA), especially during 
sports broadcasts like Kings Hockey games, Angels Baseball games, and the 
like.  They must figure that a lot SMB IT people listen to those games.  
(SMB IT people seems to include a lot of startup people having to develop 
products and run the company computers at the same time.)

/dps



 

-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
web2py-users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.