Hacker News Reader

Comment by userbinator | Hacker News Reader

Good riddance, the only thing I've ever seen PDF encryption used for is DRM. In my mind, anything that breaks DRM is a bonus.

View on HN

I know of one organization that uses it to enable early release of a time-embargoed document to prevent server overload when it's released. Instead, everyone downloads the document in advance and they release the password at the release time.

They should use a cdn

The first method sounds simpler and cheaper. You're over engineering.

I hope you're joking but it is not over-engineering if you're the kind of organization important enough to have the need to release time-embargoed documents on regular basis.

Besides, he didn't suggest they bootstrap their own CDN. It could be as simple as creating a Cloudflare account.

Not joking. If the years have taught me anything that would be pragmatism. You want to introduce a new vendor and cost centre for what? Send your docs out early followed by a password if that's secure 'enough' for your use case.

Any further guesses as to how "important" the organisation is is pointless in the absence of understanding the actual use case.

They could pgp encrypt the file.

If you're thinking about FIRST Robotics Competition, then yep that's nail-on-head about what they do. I briefly talked to one of the folks responsible for that system and they mentioned looking into using a CDN, but couldn't match the relatively low cost of serving a static file over HTTP elsewhere. That being said, the traffic is still enough to tank that entire Azure region last time I checked during the release window (other assets on the same host / their other hosts in the same region were incredibly slow to load.)

Someone once explained to me that .pdf and Microsoft office encryption have the use case of 'someone benevolent gets the file by accident (browsing a network drive maybe) opens it, sees the password screen and knows they're not supposed to read it, and gives up.

It's more the equivalent of putting it in an envelope marked Private and Confidential than locking it in a box.

In many of these cases the password is in the email the file is sent with.

Uh. And getting secured tax documents from CPAs or employers by email. Let's not suddenly pretend like encryption has no value.

They're not secured, that's the whole point.

Your distinction is not meaningful. It's like saying that TLS isn't secured because one day someone may crack it. Everything is/was secure up until the point that it isn't/wasn't.

PDF, and Adobe in general are widely known to have a terrible security record. Relying on PDF encryption to keep your data safe isn't analogous whatsoever to relying on TLS. It's more like keeping your data on a Windows 98 machine, and then acting surprised when it inevitably gets cracked.

Tax information from govt, bank statements,credit card statements sent via email are all encrypted in India; although the passwords can be easily guessed from the information present in the email.

IMO, the primary benefit of encrypting pdf in email is stopping the email service provider from scrapping the pdf.

They are also used to stop quotes and documents from being changed once they are sent to others.

There are other better ways to accomplish that like lodging a document with a third party to ensure a lack of changes... regarding quoting... preventing text capture is a futile effort that really needs to stop existing - it's a pain to deal with and provides no real security since, much like snapchat - you can never counter someone taking a picture of the screen.

Yes there are better ways but for a lot of small businesses those better ways simply do not get paid. It isn't how it should be and it will take a long time for things to change.

you can never counter someone taking a picture of the screen.

Except with digital watermarks. Photocopiers generally recognize things like currency and refuse to copy at high fidelity. The PS3 I believe would refuse to play ripped cinema soundtracks all the way through, using audio watermarking. It's conceivable that cameras could be required to do the same thing for digital restriction watermarks.

Even if they conspire with every camera manufacturer, they can't prevent someone from just retyping the text they want to quote. On a mechanical typewriter if necessary.

I guess they could try to do a denial of service attack on the typist by deliberately overusing letters from the same vertical keyboard row to wear out the finger.

Quote as in sending them a quote for product and/or services.

Ah okay, so you don't actually care about the selectability - just the immutability.

In that case a third party is the answer and has been the answer forever - if only the bank has a paper record of your mortgage then you have no guarantees they won't alter that contract on the sly - if it's lodged with a mutually trusted third party that doesn't have a vested interest with either participant then you're safe. The best I've ever seen with physical documents is a guarantee that the document hasn't been tampered with, but there isn't really a way to prove which document is the real document.

Basic integrated digital signature for documents is really nice. It can be used for DRM, but it is kind of a big deal for reports and other documents they need high integrity.

Reply on news.ycombinator.com