Is a qualified electronic signature universal?

Question

1C

The situation is as follows
. I use the services of an accounting office. They submit reports for me to the tax office through 1C-Reporting. To do this, every year I issue a Qualified Electronic Signature through them, which is actually stored with them. Because they sign the accounts on my behalf.
Recently, I discovered that these signatures are present on the Gosulug portal (for several years).
Since it is a Qualified Electronic Signature, it has the rights of a paper signature. Hence the question, can attackers take a signature from an accounting office and sign other documents for me, for example, to sell an apartment?
My guesses
As I understand it, for 1C a signature is created with an OID (object identifier) ​​that uniquely identifies the user in 1C. Other systems also require an OID to work. Those. there is a certain mechanism for delimiting rights and this is good on the one hand, but bad on the other (you need to pay for a signature for each system)
However, according to https://iecp.ru/articles/item/428240-Zapret-na-dop... OID canceled and the signature becomes universal for all. And it turns out that the signature for 1C is suitable for selling an apartment?
Where else can you read about it?

UPDATE 02/19/2021
Any signature is universal. Got a response from an expert from iecp.ru

According to Part 1 of Art. 6 of the Federal Law of April 6, 2011 No. 63-FZ "On Electronic Signature" (hereinafter - Law No. 63-FZ), information in electronic form, signed by an enhanced qualified electronic signature (hereinafter - CEP), is recognized as an electronic document equivalent to a document on paper , signed with a handwritten signature, and can be used in any legal relationship in accordance with the legislation of the Russian Federation, except if federal laws or regulatory legal acts adopted in accordance with them establish a requirement that the document be drawn up exclusively on paper.

Thus, in your case, there are risks on many issues (taking loans in your name, registering legal entities, etc.). We assure you that the presence of an object identifier (OID) in a qualified certificate before 07/01/2020 did not in any way insure you against these potential threats.

In order to avoid any troubles when using the CES, its owner must strictly comply with the information security rules given in Law No. 63-FZ, as well as the guidance on ensuring the security of using the CES and qualified electronic signature tools, which the accredited certification center must provide to the owner of the qualified certificate simultaneously with his issuance.

We recommend that you read the article "Self-defense in the electronic signature market: how to resist scammers" (https://iecp.ru/articles/item/424130-samooborona-n... ), as well as with the news "The procedure for using electronic signatures in real estate transactions is changing" ( https://iecp.ru/news/item/ 424464-meniaetsia-poriad... ).

Agreed with accountants on the following scheme
1. They keep accounts and prepare reports
2. I sign and send documents through VLIS

Thank you all.
PS. I myself am a programmer with great experience and I perfectly understand how a public key differs from a private one. But when it reaches the everyday level, it turns out a shoemaker without boots :)

Answer 1

The best solution to the problem is to prevent anyone from using their EDS and do everything yourself. Submit any reports, etc. And if you trust - at your own peril and risk.

Answer 2

I don’t understand anything in 1C, but due to work, I’m a little trained in handling cryptographic information protection. So, you grossly violated one of the rules of personal digital hygiene: never give a token with a private part to anyone! In the TC where you applied, you were obliged to instruct about this. I ordered for myself in Kontur, here is an excerpt from their memo:
5.8 Handling key information
The owner of the ES verification key certificate is obliged to:
- Keep the ES key (private key) secret.
- Do not use keys for electronic signature and encryption if he knows that these keys are used or have been used before.
- Immediately demand the suspension of the certificate of the ES verification key if there is reason to believe that the secret of the ES key (private key) has been violated (the key has been compromised).
- Update the ES verification key certificate in accordance with the established regulations.
God forbid, if something happens, you are "an evil pinocchio to yourself." The way out is to issue a token to the accountant-outsourcer only for the period of reports. It's like that, but anyway. But it's up to you.
If this worries you, you can impose a ban on registration actions with a real estate object without your personal participation, Federal Law of July 13, 2015 No. 218-ФЗ “On State Registration of Real Estate”. To do this, go to your personal account https://rosreestr.gov.ru If you have not yet collected your ES, then use the ESIA account.

Answer 3

Since it is a Qualified Electronic Signature, it has the rights of a paper signature. Hence the question, can attackers take a signature from an accounting office and sign other documents for me, for example, to sell an apartment?

I'm not sure about the apartment. It looks like there are some nuances. But yes, if it is tied to you as an individual, and not as a company.
But in general, I would not be particularly afraid - I don’t think that a large accounting company will decide to engage in such garbage

Answer 4

AFAIK, OID's are attachments to the certificate itself. Some offices (Rosreestr seems to be) may require certain OIDs to work with them. But if the actions do not require the presence of an OID, any valid digital signature will do.

Answer 5

Where else can you read about it?

You can read about how it usually ends up trusting the private key of a certificate that can be used to sign any documents on your behalf to someone else in any Internet security guide. It doesn't matter if it's an apartment or not an apartment. Someone has every opportunity to perform certain actions on your behalf (which will have legal force and the fact that they were not done by you, you will have to prove separately) - and this just now excited you :)