Strong PDF passwords are difficult to set up and use.
Why you should NOT password protect PDF files
Passwords have a strong historic precedent in protecting access to computers and files. Originally, it was the only mechanism that could be implemented – smart cards and biometrics were just a gleam in manufacturers’ eyes (and some say still are).
Over time, however, they have received increasingly bad press as a security mechanism. This is largely because systems have been implemented poorly, with little understanding of security or human psychology.
The usual approach to password management is to insist on one that has 6-8 characters and numbers and changes regularly. This approach makes people pick easy passwords so that they have a snowball in hell’s chance of remembering. The same applies when people pick passwords for protecting encrypted PDF documents (or zip files or anything similar). It is difficult to choose a password that you can easily pass on to the recipient and be sure they get it right unless you choose a short and simple one.
Managing PDF passwords & controlling use
Managing PDF passwords is, in itself, a nightmare:
And therein lies the problem. Short passwords that are easy to remember and type are just as easy for an attacker to crack with a dictionary system. They can break it in minutes, if not seconds. Even an exhaustive search for all numbers and letters for 8-character positions is stunningly quick – see Removing PDF Passwords.
Sadly, PDF passwords are still popular (as are zip passwords), despite the fact that they are easily passed on to unauthorized users and are often cracked.
This is the catch-22 of passwords: you must share the password for the security to be usable, but in doing so, severely compromizes it. If you’re using a password to enforce PDF security or DRM, any rights you gave the recipient can be passed on by simply sharing the password.
We therefore have to conclude that PDF passwords are not an effective way to implement PDF security. They are difficult to manage and easy to defeat.
Password security basics
If you do decide to go the password security route, there are several aspects you need to keep in mind. Creating passwords that follow these rules will increase the time it takes a password cracking program to compromise them (though it won’t stop users from sharing the passwords with others):
10 Reasons NOT to password protect PDF files
Although it seems like a good idea to password protect a PDF because it’s easy, most implementations are not effective. Below are 10 reasons why you should not PDF password protect files.
Why do people password protect their PDF files?
The simple answer is laziness or lack of research. They assume that passwords provide ”enough” protection, despite the fact that anybody can search the Internet and buy products that will remove them in seconds. Search for:
And at least three of the first ten search queries are for pdf password crackers.
“Document-level password protection technically isn’t DRM (digital rights management). And because of the plug-in architecture of Acrobat and PDF readers, it makes PDF a less-secure platform for DRM.” – ElcomSoft CEO Vladimir Katalov.
At a click of a button, pdf-Recover will remove the password regardless of whether it has been encrypted using the latest 256-bit AES encryption. The result is an exact replica of the original PDF without any security settings whatsoever – pdf-Recover removes all of the restrictions implemented.
So, whilst you can use Adobe to password protect a PDF file for free, the security you are getting is not adequate.
If PDF passwords are not recommended, what should I use to protect my PDF documents?
The key to a secure system is to avoid the user having to know or be involved with passwords at all.
This is best achieved by ensuring that, in a cryptographic system, keys are exchanged securely and secretly, so that even the user is not aware of, and therefore cannot compromise, the security of the system. Only if you take these steps can you be confident that the protection method you have used is resistant to both deliberate and careless compromise.
It is an accepted fact by all security professionals that the people most able to compromise any security system are the authorized users. That is not to say that users are deliberately dishonest or even malicious − rather that in most cases they are overly helpful or fail to understand the security functions that they are expected to perform. This is why phishing and social engineering attacks are among the most common.
Though it’s not easy to design, a system that does not require direct user involvement with passwords or keys is preferable. Otherwise, the integrity of the system hinges on humans, who are fallible.
Safeguard PDF Security and Enterprise PDF DRM do NOT use PDF password protection to protect your PDF documents. They ensure your PDF documents are encrypted and protected against unauthorized use and misuse without the use of passwords.
Using Safeguard Writer, you can protect a PDF file without passwords and apply DRM controls to prevent PDF copying, saving, modifying, and printing.
Safeguard uses public key technology rather than passwords.
How to protect PDF files without passwords
Locklizard enables you to protect PDF files without passwords by combining 256-bit AES encryption, a secure viewer application, and a licensing system with transparent and secure key management.
Creating a protected PDF file
Encrypting a PDF without passwords or certificates using Locklizard Safeguard PDF DRM
Safeguard Admin System
You can, but it’s not usually a good idea. It means uploading your PDF file to somebody else’s server unprotected. You have no way to verify what they will do with your unprotected copy after you upload it. Online tools also use the same password security as Adobe Acrobat and the protection will therefore be easy to remove.
All email clients that support attachments will allow you to add a password protected PDF. A good password can make it harder for an attacker to extract information should a user’s account be compromized or an email intercepted. However, there are still aspects to consider – namely, how to transmit the password to the recipient securely and the fact that the recipient can share the password with others. There are safer ways to send a PDF by email securely.
Yes, if you use Locklizard to protect it. Locklizard enables you to restrict PDF editing without passwords and stop users from copying and pasting content, screen grabbing, printing, sharing and more.
Yes, but it is no more secure. You can encrypt a PDF without Acrobat using more secure methods such as certificates or DRM.
Yes, it is easy to remove the permissions by using free software online. If you want to prevent users from printing PDFs then you need to use a PDF DRM system that does not use passwords.