There’s no doubt that passwords are the most common digital authentication method in use today. We use them to access our online accounts, log in to our computers, and secure our wireless networks. As such, it’s understandable that passwords are the first thing users turn to when it comes to protecting their PDF files. They’re cheap to apply, well-known, and can be paired with encryption and permissions systems.
The reality, however, is that securing a PDF is very different from protecting an online account or laptop. The most common document format in the world comes with some unique challenges that must be considered for a streamlined, fully secure process.
The first factor to consider is that PDFs are inherently built for sharing. You can easily find out the history and full use cases behind PDFs if you’re wondering what is PDF? Though direct sharing stats are hard to come by, we know that as of 2016, 2 billion PDFs were opened each year on Outlook.com. That’s over five million per day on a single email service.
Passwords just aren’t secure or efficient
With the massive volume of PDFs shared by businesses and regular consumers each day, it is vital that they’re efficient. Unfortunately, secure passwords do not fit that bill. A typical business receives documents from a wide range of departments, clients, and contractors, and each may use a range of passwords.
Managing these can quickly become unwieldy and may lead to poor security practices as a result. It’s not uncommon to see users storing a list in a text file on their desktop or a physical post-it note. Even if you can secure them, passwords are sent in a readable form to the user. This means they can be shared easily with others – often over unencrypted messaging services. As PDFs are opened offline, it’s all but impossible to track how many people have a password and whether it has leaked outside of your organization.
To make matters worse, the software to crack PDF passwords is some of the most accessible on the web. There are dozens of free or low-cost tools that can perform a brute force or dictionary attack to crack insecure passwords in less than half an hour. More advanced software, such as Elcomsoft, can open and modify the permissions of Adobe PDFs with 256-bit encryption in under a minute.
For enterprise customers, this doesn’t just risk the leak of confidential information. If an attacker has access to an employee’s account, they could potentially crack a PDF and insert malicious code. This could be used to gain wider access to the network, deploy malware or ransomware, and more, all seemingly from a trusted source.
Password-based permission systems are outdated
PDF password protection, then, is primarily useful if you’re sharing a document that is not valuable enough for an attacker to invest the time or money into cracking it. Even then, however, the permissions systems of software families like Adobe Acrobat allow for little granularity or customization.
Password-based permission systems don’t take into account factors such as where the PDF is being edited, the identity of the user, whether they’re a part of your organization, or if they’re an administrator. This exacerbates the issue of poor password hygiene, meaning that the password is the only requirement for entry. Adding to this is an inability to add different sets of permissions for different users, which often leads to an “all or nothing” scenario when it comes to editing rights or applying restrictions to control PDF use. Further, in the case of Adobe PDF Security, these permissions rely on an “honor” system where a third-party application agrees to enforce its restrictions. In practice, this makes bypassing it trivial.
Protecting PDF Files – the bottom line
Though it’s clear that PDF password protection has its place, the environments where it can be relied on for security are limited. Passwords have long been viewed as ineffective by the security community, and additional factors surrounding PDFs such as their offline nature and shareability make them even less suitable. When you combine this with the severe limitations of permission systems, it becomes difficult to recommend PDF password security to anyone serious about protecting their documents.
Instead, those people should look towards modern PDF DRM solutions that remove the need for passwords entirely. By integrating features like encryption, anti-screenshot technology, location tracking, and user and document revoking, these solutions make it far more likely that an organization’s data will stay within its walls, and enable secure document sharing with third parties. Though they are typically more expensive, the cost generally outweighs the risks to brand image and compliance that PDF password protection represents.
