How to Break PDF Signatures | Hacker News Reader

How to Break PDF Signatures

pdf-insecurity.org

50 pointshannob21 comments

I used to love PDF but the more time passes the more I think it is broken beyond any repair.

HTML/CSS/JS covers almost any usecase. Then there is ePub (kind of HTML.. anyway) for eBooks, CBR for Comics, DJVU for scanned content and so on. There probably is a better format for any niche usecase you can imagine.

What would you suggest for downloading technical documentation, legislation, court decisions, and academic papers?

Why would you want to download it in the first place? You can read the documents in your browser just fine and chances are you will be reading the PDFs in the browser anyway.

If you insist to download and archive it DJVU is fine for the documents you mentioned because it contains rendered graphics as well as searchable text. ePub is another option if you need vector images and outline fonts.

I give you the point about academic papers because math in the browser is subpar. I would have written "still subpar" but I think that is what I have been saying for at least ten years now - I'm not sure there is any hope. On the other hand I often read papers on my mobile and it is not as convenient as reading the web. Especially the two column layout that many papers have is a nuisance. I wish there was a way to distribute papers with beautiful math and reflowable text.

> Why would you want to download it in the first place? You can read the documents in your browser just fine

Because you don't want it to 404 on you after a year or two.

If that is your concern: "Save as..." works pretty well in modern browsers. I use Zotero for organizing the documents I want to keep and that works pretty well too. I'm sure there are other options, offline (like Zotero) or cloud based.

And there are always archive.org and archive.is...

> HTML/CSS/JS covers almost any usecase.

This doesn't cover the usecase of something that looks the same across different systems.

DJVU satisfies that requirement perfectly while PDF doesn't. If you don't embed all your fonts into the PDF it will look different on different systems and even if you do: as long as font rendering happens on the target system you will never get 100% pixel perfectly the same output.

I haven't use DjVu very much, but as far as I was aware it doesn't store vector data?

No it doesn't but vector data involves rendering on the target system and this leads to unavoidable differences between the output of different rendering systems. DJVU avoids this because it contains bitmaps. If small differences are no problem ePub is an option.

DjVI was specifically designed to contain scanned documents. It was never designed for documents which were digitally authored.

Using a rasterized technique is certainly not a good idea in an era where the DPI of screens is increasing.

Also since PDF is the standard in the printing industry I think we can safely say the margin of differences is so small they are non existent.

As in ssid, use ePub if you need vector. If you need something that will be displayed the same under any conceivable circumstances, and still will be in many years, consider DJVU. I see DJVU mainly as a viable alternative for archiving, where people usually use PDF/A or TIFF (yes some still archive everything as TIFF).

PDF consistently generates documents that anyone can see and verify the content. HTML/CSS/JS change the content different depending on how you look at them and with which tools.

> PDF consistently generates documents that anyone can see and verify the content.

You cannot rely on that. PDF combined with font and vector graphics rendering is just an insanely complex beast and there is lots of trickery that can change the appearance of the document. For example there is a font that changes its characters with font size and therefore zoom level.

When it comes to verification: see OP how well that works.

If you want verifieable content use plain text and bitmaps. Really that's your best bet.

The article lists 'Adobe Acrobat Reader DC' for Linux but I don't see a Linux option at https://get.adobe.com/reader/otherversions/ although there is an Android option, maybe there's a way to make that work on Linux, or use e.g. Windows 7 version of Acrobat with Wine. This page doesn't make it totally clear if the free reader is sane to use. https://appdb.winehq.org/objectManager.php?sClass=applicatio...

*wouldn't recommend since it hasn't been updated in a long time

ftp://ftp.adobe.com/pub/adobe/reader/unix/9.x/9.5.5/enu/

Well this is bad news for everyone.

Choice of Linux PDF viewers is very strange[1] - basically, no open source viewers listed.

[1] https://www.pdf-insecurity.org/signature/viewer.html

Does any of them support signature verification at all? Last time I checked there was pdfsig and that was it.

I think mupdf supports it if you compile it with that feature enabled, and I also heard about "mutool sign", which is supposed to be able to sign and verify, but I never used it. In fact, I don't even have the binary for some reason. I will try to compile mupdf from scratch now and see if it supports signatures properly. It would be good if it supported it right out of the box. Maybe some of their devs can clarify this.

So... I compiled it and now I have mutool.

I tried to run `mutool sign SampleSignedPDFDocument.pdf` and it gave me this output:

verifying signature on page 1

  result: ''

The PDF I am using: https://blogs.adobe.com/security/SampleSignedPDFDocument.pdf

I have no idea how I can format the output. Is there a way to use code blocks on here?

Read the FAQ: https://www.pdf-insecurity.org/other/faq.html

Basically they tested almost everything you could think of, but none of the major open source viewers supports PDF signature verification in the first place.

Is this a flaw in the format or just bugs in implementations of viewers?

Seems like it must just be fixable bugs. On the chart showing which viewers are vulnerable, some of them have no vulnerabilities.

So in theory other viewers should be able to be fixed.

Reply on news.ycombinator.com