PDF Security Issues

Frilf · 13th March 2003, 10:55 PM

Hey, all!

Got a few questions for the resident PDF wizards out there...

Which of the following features (if any) can be enabled in a PDF and still retain some measure of document security? We're talking features that would be accessible to the end-user here.

* Ability to add new bookmarks

* Highlight tool

* Underline/Strikeout/Note tools

* Stamp tool

* Free text tool

* Pencil tool

* Square/Circle/Line tool

* Text select tool

Who here has experimented with enabling these various features? What downsides are there to activating these features? Are there some features you can safely enable and others that you can't? If so, which features can be enabled without unprotecting the entire document?

The answers would not only benefit me, but others that want to know a little more about PDF voodoo. Thanks for your time and help.

Cheers!
Ian

HellHound · 14th March 2003, 02:08 AM

According to polls, disabling ANYTHING in a PDF is one of the top complaints from end-users.

No security is gained by disabling the ability to cut and paste from your PDF, except the security that no one will ever reference your OGC.

Why reduce the useability of your PDF?

After all, NO amoutn of document security will prevent people from actually pirating the PDF itself, thus any security options you engage are only effectively detrimental to your target audience, and may well ENCOURAGE piracy by making people run security bypasses on your PDF so they can access it the way they want to.

(Trust me, the first thing I did after complaining that you had put security on your first PDF was to run a security crack on it so I wouldn't have to remember the password to access the bloody thing)

cyphertube · 14th March 2003, 03:55 AM

I don't know about you, but it's been a long time since I've seen security for a PDF that's even worth really mentioning.

Given all the tech books that come out, there's a serious incentive for a number of individuals to crack PDF documents, rather than shell out several hundred dollars to break into the IT field.

I agree with above, that putting any kind of security features on that inhibit a normal user (or simply cause frequent annoyance) with seriously decrease the usability of the document.

Besides, any fool with a good print to image program and OCR software will be able to turn your locked PDF into at least a text file.

tburdett · 14th March 2003, 08:53 AM

You do realize that there are programs out there (easy to find and widely available) that will completely strip off all .PDF document security in a matter of seconds, right? Seconds.

You do realize that document security does not discourage or limit piracy of your .PDF files in any way, right? No amount of document security will prevent Joe Filetrader from sending or sharing the .PDF file with everybody he knows.

With that out of the way, you have to tell us what you are trying to accomplish by using document security before we can answer your question.

Cergorach · 14th March 2003, 11:48 AM

To answer Frilf's question, no you cannot activate or diactivate those single tools/options, it's either a whole range or nothing. The security features that the full version of Acrobat displays are it, nothing more.

I think the rest has actually covered everything i think needs to be said about securing pdf files. Only thing i want to add is that there are some options available that require a little more work (such as v5 encryption), but with the monster pcs of today that's only a couple of days number crunching and you have a 'unsecure' pdf...

Good luck with whatever you want to do, just not to stuff i'll buy...

jmucchiello · 14th March 2003, 03:58 PM

Just so you can see we aren't making this up, check out this poll at RPGNow.

Also, see what kind of discussions can occur when you lock out copy/paste. (Read the whole thread.)

And always remember, locked or not, nothing stops someone from putting your "secure" PDF up on a file share somewhere where anyone can download it.

Sir Whiskers · 14th March 2003, 06:00 PM

JM - Very interesting! I noticed the discussion thread didn't resolve the question for Game Mechanics, but it seemed to end with only a copyright issue, not piracy.

Being a novice with Adobe, a few questions:

1. I was always under the impression that pdf's are used because they are supposed to be hard to change - am I way off base here? I know that our legal department at work has authorization to send pdf's of signed documents to various government entities, in place of the real thing (the assumption being the pdf is the same as the original). Sounds like eveyone here is saying this isn't true at all.

2. Along the lines of 1. above, is it really that easy for anyone to strip off the protections in a pdf? I'm not talking the 1% who are experts - I mean the average user (like me). And nope - I'm *not* asking for directions how.

3. If the publisher does not lock down the pdf, do I, as the user, need anything other than the free Acrobat Reader to make use of the features mentioned?

4. Assuming I don't, does that mean I can copy sections from open pdf's into MS Word docs or into MyInfo (a document manager I've started using), or similar word processors? Does the copied section paste as text, or an image?

5. If 4. above is true, I can see huge benefits to the casual gamer for unlocking the features. If it's not true, how do you (or anyone else) use these features to make the product easier to use? Adding bookmarks is obvious - what else? (I'm trolling for ideas I can use myself).

6. Concerning publishing: How should a publisher communicate to the prospective buyer whether the pdf is open or not? Should it be in the description? Elsewhere? From the publisher's point of view, it should not read like a cigarette warning: "Warning. Opening this PDF file is going to be a terrible experience."

At the same time, I can see this info helping buyers make informed decisions, so publishers should be encouraged to mention it in some fashion.

I apologize in advance if these questions seem obvious, but as I said, I'm not a pdf expert. Thanks.

Cergorach · 14th March 2003, 06:48 PM

1.) The reason people use PDFs is because it keeps the original layout across platforms (99.99% of the time), it's also pretty small for the information it holds (compared to for example Word). Its also true that it's not easy to change things in the document itself, some see that as an added benefit, others as a hinderence. The failures of the security implementations in PDFs have only become 'public knowledge' pretty recently (by public i mean the top 5% instead of the top 1% ;-).

2.) Download program X from location Y => unzip program => run program => open document in program => klick button to remove security (might ask for password if that is used to open program) => save unlocked file. This works for 99% of the PDFs out there.
[note to admin: if you feel this is giving to much info, feel free to remove point two]

3.) Acrobat Reader lets you do lots of things, almost anything that the full version allows, except changing the document (adding/removing/changing anything).

4.) Yes you can select text with the text select tool, there are two versions of that. One lets you select horizontal lines of text, the other lets you select columns of text. Your selection can then be copied to any text editor as editable text.

5.) It's true, rejoice! ;-) Besides bookmarks i like to add indexes, change the format from letter to A4, default view, add links within the document, additional pages, etc.

6.) the defacto standard of pdf publishers within the RPG community is not to inhibit pdfs by locking them. It's expected so no notice should be neccecary. If it is locked, it would be stupid for the publisher to advertise that fact.

One neat feat i do like about limiting files is that publishers like Necromancer password protect some of their webenhancements and the password can be found in the product it is for, that way when i run such an adventure nothing is revealed if someone downloads those files without already having the original module. It is annoying to actually type that password everytime you want to access a file, but when you know it you can easily remove it by using some simple tools...

Sir Whiskers · 14th March 2003, 07:22 PM

Cergorach - great info. Thanks!

Frilf · 14th March 2003, 09:27 PM

Well, thanks, everyone, for your highly informative responses. That certainly helps.

I wasn't only asking for myself, but thought a thread of this type would be good for others who are just joining the PDF d20 publishing arena. It's just good information to have out there and available.

Our future products (and upgrades to existing ones) will not be locked up.

Cheers!
Ian

BTW, Jason, thanks for caring enough to crack the security on that file for me. Sheesh! I sent you an open version of the file. Did ja get it? Great Caesar's Goat, man!

HellHound · 14th March 2003, 10:33 PM

LOL

Yeah. I got the unprotected copy from you about 12 hours after I cracked the version you sent me originally.

jmucchiello · 15th March 2003, 05:57 AM

Quote:

Originally posted by Sir Whiskers
JM - Very interesting! I noticed the discussion thread didn't resolve the question for Game Mechanics, but it seemed to end with only a copyright issue, not piracy.

Yes, for some reason, the Game Mechanics believe that if they enable copy/paste from their PDF this may in some way damage their ability to prosecute copyright violators in the future. Until their lawyer informs them otherwise, they are not releasing anything with copy/paste enabled.

I don't see how setting (or not setting) a bit in a document can suddenly invalidate the copyright protections the law provides everyone but that's what they pay their lawyer for and I can't even guess how many hours he's billing them for this question since it's been 3-4 weeks since they said they were gonna ask their lawyer.

But, there's no reason to drag that thread over here. Just wait patiently. Eventually, they will discover the error of ther ways. Or we'll discover that everyone else is wrong. That'd be a hoot. But I find it unlikely.

Cergorach · 15th March 2003, 11:19 AM

Quote:

Originally posted by jmucchiello
But, there's no reason to drag that thread over here. Just wait patiently. Eventually, they will discover the error of ther ways. Or we'll discover that everyone else is wrong. That'd be a hoot. But I find it unlikely.

As if what a lawyer tells you has to be true... shees people are easily satisfied...

Dextra · 15th March 2003, 01:15 PM

Quote:

Originally posted by Cergorach
1.) The reason people use PDFs is because it keeps the original layout across platforms (99.99% of the time), it's also pretty small for the information it holds (compared to for example Word). Its also true that it's not easy to change things in the document itself, some see that as an added benefit, others as a hinderence. The failures of the security implementations in PDFs have only become 'public knowledge' pretty recently (by public i mean the top 5% instead of the top 1% ;-).

Another good reason to use PDF rather than Word is that PDFs won't carry virii into your harddrive, whereas there is considerable reluctance to open a .doc file which could contain nasty macros.

But other than that, yeah. What he said.

Frilf · 15th March 2003, 07:03 PM

BTW, for everyone who has purchased The Book of Templates (and I think I know who you are), a new update has been dispatched that is not locked. This is *not* the Deluxe Edition update, just one all the PDF features enabled. Enjoy!

Cheers!
Ian

**Piratecat** · 15th March 2003, 08:04 PM

Got it - thank you!

Cergorach · 15th March 2003, 09:07 PM

Quote:

Originally posted by Dextra

Another good reason to use PDF rather than Word is that PDFs won't carry virii into your harddrive, whereas there is considerable reluctance to open a .doc file which could contain nasty macros.

Erm... not wanting to rain on your parade, but virii can still be caried by pdf. It's not as easy or well known as with docs, but it's still posible because you can script in a pdf...

Psionicist · 17th March 2003, 05:33 AM

What Cergorach said. And please, it's "virus". That other word was really cool when I was 11 years old and programmed BASIC. Welcome to the future lads.

Flyspeck23 · 17th March 2003, 12:07 PM

"Virus" being a latin word, the correct plural should in fact be "virii" (although I might be wrong, seeing how much I sucked in latin at school...). But that´s off-topic.

Outlook Express seems to think like Cergorach, because it keeps deleting any PDFs sent to me (just last week, as one of my players sent me his updated PDF-character sheet...). Ups, off-topic again...

On the copyright issue: in what way are books "copy-protected"? In no way. So why should it be a problem with e-books?

jmucchiello · 17th March 2003, 09:02 PM

Quote:

Originally posted by Flyspeck23
"Virus" being a latin word, the correct plural should in fact be "virii" (although I might be wrong, seeing how much I sucked in latin at school...). But that´s off-topic.

Virus is also an English word and its plural is "Viruses". This sometimes causes people who know latin some confusion.

Quote:

On the copyright issue: in what way are books "copy-protected"? In no way. So why should it be a problem with e-books?

You can copy protect a book by printing it on high-gloss paper so that the photocopier just spits out black smeary mush when you try to "copy" the book. How this is similar to a copy/paste bit in a PDF, I have no idea.