From: "Daryl Colquhoun" <atw@xxxxxxxxxxxxx>
Subject: Re: pdf security isn't as bad as it seems
Date: Sun, 31 May 2009 23:04:48 +1000
David said:
One trick I have used to extract content out of a locked PDF is to
print
the pdf to pdf.
(This is known as 'reboiling' the PDF.) But Rhonda had no luck.
Rhonda is using Acrobat, which is 'conforming' software while David
is using
non-Adobe software, presumably 'non-conforming'.
'Conforming' means that it conforms to the standard, which is now an
ISO
standard, ISO 32000-1:2008, also available (free) at
http://www.adobe.com/devnet/pdf/pdf_reference.html. In 7.6.3.1, we
find
'[A] conforming reader technically has access to the entire contents
of the
document. There is nothing inherent in PDF encryption that enforces
the
document permissions ... Conforming readers shall respect the intent
of the
document creator by restricting user access ... according to the
permissions
contained in the file.'
Essentially, PDFKeyPro (which is one I have not seen) appears to be a
nonconforming reader which generates a PDF with the print protection
removed.
HOWEVER, the point I really want to make is that the print (and
copy, merge,
form-fill, etc) permission(s) are handled quite differently from
protection
of the document against being opened. Bill's print-protected
document has an
owner password. If you protect the document against being opened at
all, it
has a user password. Documents may have either or both.
And, to get to the point at last, I believe that the protection
afforded by
a user password is pretty good. More to come when I complete my
researches.
On the story of the Russian ElcomSoft programmer, a quick search
reveals
that he wasn't cracking PDFs but Adobe eBooks. ElcomSoft is now,
according
to http://www.elcomsoft.com/company.html (and other sources), a
Microsoft
certified partner, and therefore respectable. ElcomSoft's website is
interesting.
***********************************
