Password Maintenance
Strong PDF passwords are difficult to set up and use.
Why you should NOT password protect PDF files |
If you want to protect a PDF securely then DON’T use passwords. They have 2 major weaknesses:
Put simply: password protection = NO protection.
What should I use to protect PDF files? |
The key to a secure system is to avoid the user having to know or be involved with passwords at all.
This is best achieved by ensuring that, in a cryptographic system, keys are exchanged securely and secretly, so that the user is not aware of, and therefore cannot compromise, the security of the system. You can then be confident that the protection method you have used is resistant to both deliberate and careless compromise.
The people most able to compromise any security system are the authorized users. That is not to say that users are deliberately dishonest or even malicious − rather that in most cases they fail to understand the security functions that they are expected to perform. This is why phishing and social engineering attacks are common.
Though it’s not easy to design, a system that does not require direct user involvement with passwords or keys provides the best PDF protection. Otherwise, the integrity of the system hinges on humans, who are fallible.
Locklizard has two PDF protection solutions that protect a PDF file without passwords. Safeguard PDF Security and Enterprise PDF DRM do NOT use PDF password protection to protect your PDF documents. They ensure your PDF documents are encrypted and protected against unauthorized access and use.
Safeguard uses US Gov strength AES encryption to encrypt PDFs, public key technology, DRM and license controls to ensure your PDFs remain protected at all times. See our DRM Technology.
Protect PDF files without passwords and choose from a wide range of granular DRM controls to tightly control access and use.
How to protect PDF files without passwords |
Locklizard enables you to protect PDF files without passwords by combining 256-bit AES encryption, a secure viewer application, and a licensing system with transparent and secure key management.
Creating a protected PDF file
PDF protection without passwords
Safeguard Admin System
10 Reasons NOT to password protect PDF files |
Although it seems like a good idea to password protect a PDF because it’s easy, most implementations are not effective. Below are 10 reasons why you should not PDF password protect files.
PDF protection & password security basics |
Passwords have a strong historic precedent in protecting access to computers and files. Originally, it was the only mechanism that could be implemented – smart cards and biometrics were just a gleam in manufacturers’ eyes (and some say still are).
Over time, however, they have received increasingly bad press as a security mechanism. This is largely because systems have been implemented poorly, with little understanding of security or human psychology.
The usual approach to password management is to insist on one that has 6-8 characters and numbers and changes regularly. This approach makes people pick easy passwords so that they have a snowball in hell’s chance of remembering. The same applies when people pick passwords for protecting encrypted PDF documents (or password protect a Word document, zip files, or anything similar). It is difficult to choose a password that you can easily pass on to the recipient and be sure they get it right unless you choose a short and simple one.
If you do decide to go the password security route, there are several aspects you need to keep in mind. Creating passwords that follow these rules will increase the time it takes a password cracking program to compromise them (though it won’t stop users from sharing the passwords with others):
Managing PDF passwords & controlling use |
Managing PDF passwords is, in itself, a nightmare:
And therein lies the problem. Short passwords that are easy to remember and type are just as easy for an attacker to crack with a dictionary system. They can break it in minutes, if not seconds. Even an exhaustive search for all numbers and letters for 8-character positions is stunningly quick – see Removing PDF Passwords.
Sadly, PDF passwords are still popular (as are zip passwords), despite the fact that they are easily passed on to unauthorized users and are often cracked.
This is the catch-22 of passwords: you must share the password for the security to be usable, but in doing so, severely compromizes it. If you’re using a password to enforce PDF security or DRM, any rights you gave the recipient can be passed on by simply sharing the password.
We therefore have to conclude that PDF passwords are not an effective way to implement PDF security. They are difficult to manage and easy to defeat.
Why do people password protect PDF files? |
The simple answer is laziness or lack of research. They assume that passwords provide ”enough” protection, despite the fact that anybody can search the Internet and buy products that will remove them in seconds. Search for:
And at least three of the first ten search queries are for pdf password crackers.
“Document-level password protection technically isn’t DRM (digital rights management). And because of the plug-in architecture of Acrobat and PDF readers, it makes PDF a less-secure platform for DRM.” – ElcomSoft CEO Vladimir Katalov.
At a click of a button, pdf-Recover will remove the password regardless of whether it has been encrypted using the latest 256-bit AES encryption. The result is an exact replica of the original PDF without any security settings whatsoever – pdf-Recover removes all of the restrictions implemented.
So, whilst you can use Adobe to password protect a PDF file for free, the security you are getting is not adequate.
If you are still not convinced, see Removing PDF Passwords and PDF Security cracks and flaws.
PDF Protect FAQs |
You can, but it’s not usually a good idea. It means uploading your PDF file to somebody else’s server unprotected. You have no way to verify what they will do with your unprotected copy after you upload it. Online tools also use the same password security as Adobe Acrobat and the protection will therefore be easy to remove. An example of an online password protection solution is PDFProtect which is now owned by SodaPDF.
All email clients that support attachments will allow you to add a password protected PDF. A good password can make it harder for an attacker to extract information should a user’s account be compromized or an email intercepted. However, there are still aspects to consider – namely, how to transmit the password to the recipient securely and the fact that the recipient can share the password with others. There are safer ways to send a PDF by email securely.
Yes, if you use Locklizard to protect it. Locklizard enables you to restrict PDF editing without passwords and stop users from copying and pasting content, screen grabbing, printing, sharing and more.
Yes, but it is no more secure. You can encrypt a PDF without Acrobat using more secure methods such as certificates or PDF DRM.
While Adobe Experience Manager document security offers an improvement over PDF password protection, users who can view a document are still able to take screenshots. And while AEM also enables you to protect a Word document from editing or copying and other Office docs, it also has some serious security flaws.
Yes, it is easy to remove the permissions by using free software online. If you want to prevent users from printing PDFs then you need to use a PDF DRM system that does not use passwords.
PDFProtect is PDF protection software that uses passwords to protect PDFs. Just like Adobe Acrobat and other PDF password protector software, PDFProtect has the same security issues – users can share passwords and restrictions can be instantly removed. It is therefore not advisable to use PDFProtect for the sharing of confidential and sensitive documents.
A PDF password protector is an installed software app, tool, or online service, that protects PDFs using passwords. PDF password protector applications are pretty useless since they don’t prevent sharing, copying, editing or printing since users can instantly remove restrictions or permissions.
At a minimum, the PDF file has to be encrypted. Permissions or restrictions can then be added to prevent editing, copying and printing. If the PDF protection can be easily removed (i.e. Adobe password protection or similar PDF password protector apps) then you are wasting your time adding it. If you want to protect a PDF from sharing, copying, editing and printing then only passwordless DRM can achieve this.
One that does not use passwords for protection. This is because they can be shared, broken or removed and any restrictions added are completely useless.