Security of protected documents with blank owner password?

[ANI]

I recently came across with this article. I just wonder if the "Mistake #2: Using a blank owner password" is valid for documents protected with PDF-XChange Editor V6, or if it is no longer valid, or if it has even never been valid...

A short reasoning is also appreciated.

[Will - Tracker Supp]

Hi ANI,

Thanks for the post - It's valid for almost any PDF reader/editor capable of securing and document and there isn't any other way to handle that. User passwords restrict what can be done in a document, but do not actually encrypt it; this is by design, so that anyone can view the document but not just anyone can edit it.

An owner password, on the other hand, actually encrypts the document which means that a password is required to open and decrypt it. This stops people from even viewing a PDF without a password and is undesirable in many instances. Using a digital signature is much more secure, because they are more widely supported, but suffers the same essential drawback to a user password.

The same principle is true for any file, regardless of file type or application; if a file is not encrypted, the security can be stripped/ignored. The MAC OS X Previewer does this because it notoriously does not support many features in the PDF spec. and, in some instances, does not adhere to the spec. at all.

Thanks,

[ANI]

Hi Will, and thank you for your reply!

I think that this will now get interesting. I hope that you can bear with me and go thru this very slowly...

When I read the article I linked in my OP I got the impression that the user password is the password required to open the PDF file and the owner password is the password required to e.g. modify the file. But from your reply I got exactly the opposite impression: You wrote that an "owner password" is required to open and decrypt the file.

(I'm also under the impression that "user password" and "owner password" are somehow standardized keywords with a fixed meaning when talking about PDF documents. Please correct me if I'm wrong!)

So...

Question 1: Within PDF-XChange Editor, how exactly do the "Document Open Password" and "Change Permissions Password" map with the terms "user password" and "owner password"?

Question 2: Can you confirm that setting only the "Document Open Password" actually encrypts the document contents?

Question 3: Can you confirm that setting only the "Change Permissions Password" does not encrypt the document contents?

Question 4: If I understood you correctly, the liked article in my OP had erroneously switched the terms "user password" and "owner password" with each other, and that being true, the Mistake #2 in the article does not make any sense after all. I mean, shouldn't it be obvious for everybody that setting ONLY the "Change Permission Password" should NOT prevent anyone reading its contents. Do you agree with this, too, or am I still missing something?

[Will - Tracker Supp]

Hi ANI,

Looking over, it may actually be myself that has gotten user and owner passwords mixed up. I've heard the terms used a few times, but typically we simply refer to "Document Open password" and "Editing password" (or "Restrictions password"), so I'll clarify that as I may be confused there.

But essentially, yes; a password to open the document does encrypt the contents, at least with the Editor (I obviously cannot speak for other apps).

Question 3: Can you confirm that setting only the "Change Permissions Password" does not encrypt the document contents?

That's correctly. If a document is encyrypted, you cannot even view it without entering a password. As fas as I'm aware, it's not possible to encrypt the contents of a file and still view them without the password. To over simplify, encryption basically scrambles the contents of the file and decryption unscrambles them:
http://www.east-tec.com/kb/what-does-encryption-mean/

Question 4: If I understood you correctly, the liked article in my OP had erroneously switched the terms "user password" and "owner password" with each other, and that being true, the Mistake #2 in the article does not make any sense after all.

Again, I could quite possibly be the one that's confused. The PDF Spec. and the format in general are so vast, and my experience with PDF's has been solely limited to my time with Tracker, that I definitely don't know even close to everything about the format or the general terminology. I had thought that owner password was the Doc. Open password, but looking again I believe it may be the opposite. I'll check that with my colleagues when they're online.

I mean, shouldn't it be obvious for everybody that setting ONLY the "Change Permission Password" should NOT prevent anyone reading its contents. Do you agree with this, too, or am I still missing something?

It should, yes. Requiring a password to edit the document definitely does not encrypt it and can definitely be ignore by other apps (as the article demonstrated), and can also be stripped by some services/applications (I obviously cannot advise on what these might be or where you can find them, even for academic purposes).

Essentially, just bear in mind that if you want a document to be truly secured, you'll need to put both passwords on the document and supply only the password to open it. See this file (passwords in the name):

123--Open_abc--Edit.pdf

(4.83 KiB) Downloaded 110 times

**Edit**
Thinking it over - I'm confident the article you posted is correct on the terms; User Password is the password granted to allow the user to open the document. Owner Password is granted to allow full editing of document, as if you/they were the owner.

However, the important point as I've always been told, is that so long as you require a password to open the document, it is encrypted. Again, I can only speak for our application. See here:


Cheers,