Back to Docusign.com
I just found out today that if a recipient forwards the email that they receive with the link to the envelope and they already opened and authenticated their access using and Access Code, then the person that they sent the link to can open the document and basically just sign it as the first person. This seems risky to me. Also, the Authentication Settings for the Access Code feature basically do not allow for a person to require an access code for each new browser. Basically, its either every single time or only once - no in between. So all someone who is being nefarious would need to do is wait until you look at your document, allow you to enter your access code and then - boom, they’re in signing as if they were you with no record on the certificate.
Per the Authentication Settings, "When using Access Codes with this setting, the recipient is not prompted to authenticate again after the first time, even if using a different device."
I would like to suggest that this be changed in light of the forwarding issue, to allow for this to be switched to allow for the same as Phone Authentication, SMS Authentication, and Knowledge-Based ID checks. It should be allowable to require the access code every time they log in from a different browser. Like in the setting "Any recipient must authenticate on every envelope sent from this account"
