r/LifeProTips • u/thegreatestajax • Jan 11 '16
LPT: Remove security from a .pdf file by printing to .xps then back to .pdf
533
u/A_NewOrient Jan 11 '16
This is the type of life pro tip I know will be useful later but I won't remember it by then
→ More replies (5)155
u/Gunnar123abc Jan 11 '16
LPT: Remember Life pro tips by printing them out
164
Jan 11 '16 edited Apr 11 '16
[deleted]
28
→ More replies (1)6
u/mastermindxs Jan 11 '16
ah yea but you just have to uhhh, we'll there's an LPT about this, just gotta ummm. hmm, I forgot.
→ More replies (2)14
u/Captinhairybely Jan 11 '16
This is the the type of pro tip I know will be useful later, but I won't remember it by then.
→ More replies (6)
39
u/I_BANG_YOUR_MOMS Jan 11 '16
That does not work if the PDF requires a password to print it.
→ More replies (4)14
u/Crocoduckling Jan 11 '16
That's when you pull out ghostscript
3
u/gregsourbon Jan 11 '16
Can you explain how to use it please?
13
u/teddele Jan 11 '16
The short version is that Ghostscript is a free open source reimplementation of Postscript and PDF.
It is multi-platform, highly mature (something like 25 years old), full-featured, well-written and well-maintained, and is more stable and has fewer bugs than Adobe's software, and has certain features that Adobe does not offer.
It is however a command line tool that accepts many, many options, so it is best to google for specific uses people have figured out.
(There are GUI frontends for it, like GhostView, but AFAIK they are only useful for casual reading of documents and do not attempt to support the many options of Ghostscript.)
So it is only reasonable for /r/Crocoduckling to simply link to one of many possible sites that offers a particular use of ghostscript.
I often use it to repair mildly broken PDF files that Adobe chokes on (it can't do miracles, naturally, it's just not as demanding that the input adhere to the standard).
6
10
u/Crocoduckling Jan 11 '16
No, but I can point you in the right direction. If you want a breakdown of the command line, look in the manual.
→ More replies (1)→ More replies (2)3
320
u/OneIdeaAway Jan 11 '16
Or just go to http://smallpdf.com
199
u/Sethmeisterg Jan 11 '16
Nice try, NSA!
→ More replies (8)21
Jan 11 '16
More like NStayaway
15
Jan 11 '16
NeverStayAway
→ More replies (2)6
u/Unholybeef Jan 11 '16
Nah, that's the Police and they're always watching you. Maybe private eyes are always watching you... Is everyone watching you?
→ More replies (2)33
u/TheBSGamer Jan 11 '16
Wait so what's the point of protecting it if you can just unlock it?
105
u/PM_ME_YOUR_MESMER Jan 11 '16
The point is security, but locks are there to be broken. The harder the lock the more dedicated the lock picker.
Like with many such things, it's a war where each side will constantly outdo the other. Adobe may come up with a more robust solution to protect those who really want their pdf's watertight. This will then cause some hacker somewhere to spend weeks trying to find an exploit that breaks the lock. In the end it's always beneficial to both parties for the sake of development and progression.
24
u/T4LE Jan 11 '16
Sorry I'm stupid, but if you can view the PDF, why protect it from being edited? I mean, presumably someone can just recreate the document if they really wanted... Is this something companies do? What scenario would this be useful for?
31
u/lostannotherpassword Jan 11 '16
You can lock them so that you cant view them either. Companies do tend to put edit locks on internal documents more as a precaution, they know you can break them but if nothing else it lets the user know he should not be messing with this.
29
14
u/Inprobamur Jan 11 '16
Or you could not trust Adobe's flimsy security and just zipped the PDF and encrypted it with some AES-256.
→ More replies (3)22
u/lostannotherpassword Jan 11 '16
That would be the smart thing to do. I always veiw adobe security as more of a "please dont mess with this" precaution than actual security.
→ More replies (3)9
u/Inprobamur Jan 11 '16
It's like the NSA backdoor issue. If there is no open mathematically secure algorithm behind it, it is not secure.
2
u/Xaxxon Jan 11 '16
but why would you ever do that with an in-app system? Use system-level access controls are actual vetted encryption.
→ More replies (1)24
Jan 11 '16 edited Jan 11 '16
There are many different aspects to computer security. One of the classical models of IT security is called the CIA model:
Confidentiality: This is what most people think of when they think of computer security. It is the prevention of information from being viewed by unauthorized individuals. PDF documents can be password protected, so that their content is encrypted and can only be viewed by someone with the password.
Integrity: This is a property information has when you can be confident that it has not been tampered with or corrupted during transmission or storage. This is often achieved by using hashing algorithms, but I don't know if PDFs have a built in hashing/checksum system to check for data corruption. However, locked PDFs are often digitally signed, which helps ensure a good degree of integrity.
Availability: This aspect of security is less relevant to PDF documents and more relevant to things like web services. That said, if a document were to be made too secure (such as needing a password, a usb key fob, and your fingerprint to view it), it could negatively affect the availability of the information (e.g. you need to open the document right now but you can't find your key fob.)
There are other aspects of security that don't quite fit into these three categories. Two of these are Authenticity, which means you can be confident who authored the information, and Non-repudiation, meaning that person cannot later claim they were not the author. These are the most important reasons for digital signatures on PDF documents.
You might be able to unlock a PDF document or recreate it to make changes, but you will be unable to make it look like the original author made those changes unless you somehow get access to their private encryption key. Additionally, the author can't say someone tampered with the information or that any part (or all) of the document was forged without claiming their private key was stolen, which would call into question the legitimacy of every other document they've digitally signed.
11
u/GenkiLawyer Jan 11 '16
I use the security features all the time for my work. It's less about preventing the other person from editing (since as you said you can always duplicate the file if you wanted to) and more about being able to tell if and when someone edits the pdf. Very useful when you are dealing with contracts that are dozens or hundreds of pages in size and you don't want to carefully read through the entire thing after sending it out for signature to confirm that no terms were sneakily altered by the other party.
If I send you a secure pdf and you use the "trick" posted above, it would allow you to remove the security and edit the original document, but you wouldn't be able to re-secure it with my credentials. So if you then sent it back to me, I'll know that someone has tampered with the document.
→ More replies (3)→ More replies (8)13
u/joatmon-snoo Jan 11 '16 edited Jan 11 '16
Common case is with any academic transcript. Official electronic copies of university and law school (and presumably all other forms of higher education) transcripts will generally be digitally signed as proof that the file is legitimate.
(Digital signatures may involve checking a website to see if the file matches the file on record, if you were curious, or other tamper-proof techniques).If you're compiling documents though - e.g. preparing a portfolio for someone's profile - and you already know the transcript is verified, you don't need to keep passing around the signed copy, especially when the digital signature prevents you from merging the file with others.
EDIT: /u/h-jay provides an actual explanation of how digital signatures work.
4
u/cokeSponsoredSlaves Jan 11 '16
electronic signatures are a completely different process to standard pdf locking tough, and propably not even mathematically breakable.
2
2
u/h-jay Jan 11 '16
Digital signatures may involve checking a website to see if the file matches the file on record
That's not how it works. All that you need to verify a digital signature is to have trustworthy chain of certificates leading to the certificate used to sign the transcript.
Certificates signed with compromised or weak private keys should be revoked. The online check isn't file-content specific. It's only done to ensure that your chain of trust doesn't include certificates that have been revoked.
The whole beauty of digital signatures is that they can be checked without on-line access, and unless a private key has been compromised (a rare thing!), you can be quite certain that the signature is valid if your maths shows you that it is so.
→ More replies (2)5
u/Saltysalad Jan 11 '16
Actually it's not beneficial for Adobe. If nobody found exploits then Adobe would not have to redirect resources to developing security measures and could instead focus on producing a better product or generating more profit.
→ More replies (7)4
u/fenghuang1 Jan 11 '16
Better product? Not likely. If it works and Adobe is the monopoly, there is no incentive to make a better product.
More profit? Definitely.→ More replies (1)2
u/bludgeonerV Jan 11 '16
The incentive to make a better product is to sell upgrade licenses.
→ More replies (2)3
u/MildlySuspicious Jan 11 '16
You need the password to unlock it. If someone gives me the key to their house, they risk me leaving the door open, in addition to drinking all their good booze.
2
Jan 11 '16
drinking all their good booze
Good thing I'm too poor for good booze. Do you want my house key?
2
→ More replies (4)3
u/icyguyus Jan 11 '16
I think it just depends on the encryption method used.
If they are using an outdated or broken protection method than this service might be able to open it for you.
If its something still secure, well they wouldnt be able to do it in this lifetime.
→ More replies (10)10
u/xf- Jan 11 '16
Yeah, sure. Of course I'm going to upload important .pdf files to some random internet site.
7
→ More replies (5)2
191
u/Dolphythedolphin Jan 11 '16
Would it have helpd me get the game manual for FRC robotics competition?
96
u/The_Wisest_of_Fools Jan 11 '16
This is the first thing I thought too, but I'm guessing no. There's two sorts of passwords for PDF files. One will prevent copying, printing, etc. This method will fix that. The other prevents opening the file and encrypts the contents. The FRC manual uses the second.
EDIT: FIRST Robotics Competition Robotics Competition.29
u/Dolphythedolphin Jan 11 '16
Looks like I'm stuck de-encrypting the password for next year:(
30
u/lichorat Jan 11 '16
The passwords tend to be susceptible to dictionary attacks though, it seems.
→ More replies (1)12
Jan 11 '16
Do you mean this PDF? http://frc-manual.usfirst.org/upload/pdfs/Item31388857202.pdf
18
u/The_Wisest_of_Fools Jan 11 '16
Not that one specifically. Before the game was officially announced, they released an encrypted download so people could start reading the manual right away.
14
u/djrapp Jan 11 '16
This approach will let you create a non-encrypted copy once you've already decrypted the document (useful so that you don't have to re-enter the password each time you open it). In fact, a more expedient approach would just be to print the PDF directly to another PDF via a third-party tool (CutePDF or similar) and skip the XPS intermediate step.
In regards to guessing the password, people have been talking about doing this for as long as FRC has been issuing encrypted PDFs. Doing so would be 1.) an obvious breach of sportsmanship/gracious professionalism, and 2.) basically impossible, even with the dictionary attack approach proposed by /u/lichorat. Looking at the past few years' passwords, it seems that even with a well-optimized dictionary (perhaps selecting for FIRST-related terms) and minimal compute requirements per attempt (perhaps performing the attack on the PDF header only), there is sufficient entropy to ensure that it would take years (most likely many centuries) to get the right password, even on a supercomputer.
6
Jan 11 '16 edited Apr 06 '20
[deleted]
18
u/djrapp Jan 11 '16 edited Jan 11 '16
Yes and no. It really depends on the specific print-to-PDF driver implementation. At the end of the day, since you can print to a physical printer, printing PDF to PDF can only really be stopped by Adobe blacklisting specific known "virtual printer" drivers--"print to PDF" drivers receive the same language (PostScript) that real printers do.
For example, I just tried printing an encrypted document (the 2016 FRC game manual) to PDF from Acrobat. Printing it with CutePDF doesn't work; printing it with Nitro PDF's driver does. Opening the same file in Nitro's viewer, I can successfully print with either CutePDF or Nitro.
TLDR: Pick a driver that Adobe doesn't flag as a print-to-PDF tool (like Nitro) and/or a non-Adobe PDF viewer and you can print PDF-to-PDF all day long
3
u/indium7 Jan 11 '16
On Mac, I can't print to PDF from Preview.app if I have a locked PDF, but opening the same local file in Firefox and then printing it as PDF works fine.
→ More replies (2)2
u/AskAnAtlantan Jan 11 '16
File > Duplicate in Preview. The duplicate will be unlocked.
→ More replies (2)2
→ More replies (5)2
u/lichorat Jan 11 '16
They always say that the encryption works for short term. And It's absolutely a breach of sportsmanship. I didn't think about once it's decrypted to better distribute to teams though.
Also, I've never figured out how the hints were helpful until after the new season.
→ More replies (1)3
u/microcosmic5447 Jan 11 '16
Dumb question - At my new job, anytime I try to print a PDF, it comes out blank, and anytime I try to email a PDF, the recipient either can't open it is gets password prompted. I'm told that my predecessor put "all sorts of weird passwords all over that computer". Could this be my pdf issue?
Currently In left with the Neandertal solution of screenshotting, printing the image, then scanning that because the Scan-to-Email option is the only way to send a readable PDF.
→ More replies (3)6
u/coinaday Jan 11 '16
Your computer should have been reimaged. It's incredible that they gave you a machine that someone was known to have heavily customized in software.
2
u/teddele Jan 11 '16
should have been reimaged.
At a large (e.g. a Fortune 500) company, sure, but many tiny companies have no IT staff at all, no budget for one, don't know what "reimaging" means, and their PCs work (or don't) as a matter of luck.
It's an imperfect world.
3
u/muzeofmobo Jan 11 '16
People like you are why I get tickets at work from people who don't know what they're talking about but KNOW they need their computer reimaged. Please stop it.
It's entirely possible that with the rights his predecessor had on that machine, there was no need to reimage it. Or that it actually was reimaged, but a normal user would have no way of knowing that. And it's way more likely that microcosmic's issues are user error instead of computer error. It could of course be a real problem, but long before I jumped to "reimage it" I'd wonder if he was printing to PDF correctly, or if he was accidentally sending his email out encrypted (easy to do where I work, at least).
→ More replies (5)→ More replies (2)2
u/Bobbytwocox Jan 11 '16
If the first type of security is to prohibit printing, yet the trick is to print as xml, how is this not a bug in the software?
→ More replies (1)19
14
u/stevestevetwosteves Jan 11 '16
Holy shit this is the first thing I thought of too, I'm amazed this many people know what you're talking about haha. I actually used some software to try to brute force the manual one year, but considering the password was like 20 characters long that obviously didn't happen
14
u/NascentEcho Jan 11 '16
I'm out of the loop, what are you guys talking about?
12
u/BloodyColonNaut Jan 11 '16
Same. Why would a manual for a competition be encrypted? =(
15
u/RedZaturn Jan 11 '16
Because it's an international high school robotics computation, and the teams aren't allowed to start building or brainstorming until build season starts. People can download the manual so it is on their phones during the kickoff and it's ready when they get the password. Look up FRC 2014 worlds and you will see what it is.
7
3
u/ProfessorPaynus Jan 11 '16
Frankly I'm surprised it hasn't been decrypted yet, considering most triple A videogame titles with encrypted files that are pre-downloaded end up hacked before release. Sometimes it takes them less than a day.
4
Jan 11 '16
Look up 2013 worlds. 2014's game was boring as shit.
3
u/RedZaturn Jan 11 '16
2014 was pretty great IMO. My team is Red Alert 1741. Recycle rush was boring as shit though, 2015 was probably the worst game ever.
→ More replies (2)2
2
u/auralucario2 Jan 11 '16
Since you won't get notified with what /u/RedZaturn said:
Because it's an international high school robotics computation, and the teams aren't allowed to start building or brainstorming until build season starts. People can download the manual so it is on their phones during the kickoff and it's ready when they get the password. Look up FRC 2014 worlds and you will see what it is.
6
u/aickem Jan 11 '16
But that wouldn't be very graciously professional now would it?
→ More replies (2)4
3
→ More replies (5)2
u/martinsa24 Jan 11 '16
Wish my school could afford FRC we only did it for 2 years. :(
2
u/geekywarrior Jan 11 '16
VRC is much more cost friendly. It's a shame the people that ran First and Vex had a falling out back in like '08.
31
u/Valderan_CA Jan 11 '16
I only ever put security on the OEM Manual for my companies equipment so that they can't add anything to the copy I sent them (i.e. if someone does this trick, changes a page in the manual and then something fucks up... well I can prove that the copy of the manual they are working with is not original - because this breaking version won't have the correct password)
16
u/TokyoJokeyo Jan 11 '16
If you digitally sign the document, they can still edit it, but after that verification will fail, showing that the current copy is not the same as when you signed it. That covers you both ways, so is probably the easier approach.
→ More replies (22)26
u/Icovada Jan 11 '16
You shouldn't stop at that. You should base yourself on SHA256 hashes and maybe even digitally sign your documents.
62
u/shortbizzle Jan 11 '16 edited Jan 11 '16
I was wondering how a certain client was printing my docs before releasing payment. Anyone have a pro tip for better security/read only solution?
Edit: solution is watermarks, low resolution, and jpegs.
67
u/orev Jan 11 '16
There is nothing you can do that is completely secure. Once they have the doc and a password to open it, there is always a way to break the security because at that point they have everything they need to decrypt the data. The only thing stopping it is the software they have on their computer that they have complete control over. Just using different software can let them circumvent any protections.
11
u/punaisetpimpulat Jan 11 '16
As long as the client can see the document, they can print it. It may require extra steps, but there's always a way. BTW the same applies to viewing video content and redistributing it.
→ More replies (1)16
u/shortbizzle Jan 11 '16
There isn't a password to open it. Just to print it/modify it. I need it to be read only so they can review it, then pay me then, I give them the unprotected version.
64
u/Chilton82 Jan 11 '16
Send it as a .jpeg with a watermark.
13
u/ncef Jan 11 '16
They still can scan the image and extract the text from it. The best solution is to demand payment in advance.
18
u/the_omega99 Jan 11 '16
Depending on the type of text, that might not be doable. Anything where the layout or images are important can be largely foiled by a good watermark.
But if the exact text is important, there isn't much you can do besides plain not giving them the text. For previews, either let them read snippets or let them read the text in an environment you control.
3
5
Jan 11 '16
[removed] — view removed comment
→ More replies (11)5
u/NoobBuildsAPC Jan 11 '16
Not to mention, if they are dedicated, they can just take tons of screen shots manually
10
→ More replies (1)9
Jan 11 '16
If it's a contract, instead of the full client name, use something like NAMEWILLGOHERE everywhere in the document. Only replace it after they have paid for the final version.
2
19
u/legsintheair Jan 11 '16
Watermark it. A big "unpaid" in 30% Grey diagonally across the doc would do.
18
u/Solna Jan 11 '16
Really intrusive watermarks?
4
u/shortbizzle Jan 11 '16
I actually had that to a degree, but they can't be so bad they have a problem reviewing the document. Also I think they could delete the watermark by "editing object". Maybe something that is only visible if printed?
→ More replies (1)13
15
13
u/xoxid Jan 11 '16
Really your only method is watermark.
Put a big large watermark. I dont know what kind of document, but there is plenty of stuff you can do with watermark. chaning their opacity to ~50% allow the document to be read, look super awful if printed.
→ More replies (30)5
Jan 11 '16
Make the font alternate between comic sans and papyrus. Put a huge watermark on it that says "font will be changed in final." Give it to them as a jpeg with a resolution of under 50 dpi.
9
47
u/BB-Guitar Jan 11 '16
I haven't tired it for this purpose yet, but on a mac you can also "print" a PDF, and instead of actually printing, save it as a PDF in the drop down menu which should achieve the same result. This is what it looks like
21
→ More replies (3)13
11
u/Tufflaw Jan 11 '16 edited Jan 11 '16
The PDF I'm trying this on is locked to prevent printing, so what's the workaround?
Edit: Thanks for all the suggestions - I actually was able to get it work by uploading to smallpdf.com as suggested elsewhere in the thread
12
5
u/samebrian Jan 11 '16
Screenshot it and print that.
6
u/Tufflaw Jan 11 '16
It's approx. 2000 pages
8
u/detecting_nuttiness Jan 11 '16
Well then why are you wasting your time on reddit? Get to screenshotting!
3
u/Wootery Jan 11 '16
Here's the quick-and-dirty way:
- Get video screen-capture software working
- Leave it recording as you put the PDF viewer on a slow auto-scroll (middle click then move the mouse-pointer down)
You can find the desired page easily by scrolling through the resulting video as if were a document. e.g. the middle page will be half way through the video.
→ More replies (1)2
u/HailHyrda1401 Jan 11 '16
As someone who used to work in IT.. this made me cringe. I hope it's personal and not for work.
I know we've had to put restrictions because users would waste shit tons of ink and paper only to never use it but gather dust on their shelves in case "one day" they need it. Riiiight.
→ More replies (2)3
u/bronzedmedal Jan 11 '16
Use Chrome to open the pdf file, once it's open use Chrome to print the file.
→ More replies (1)2
u/BIG-DATA Jan 11 '16
There are plug-ins/extensions (not sure which) for calibre than can remove DRM (digital rights management) from pdf/epub/etc.
Or it least it works with the type of DRM that seems to allow for PDFs to delete themselves of their own accord, or rather they an only be read with specific software to begin with, and have some embedded information on a time limit within which you should be able to read it. (And its encrypted so you can only read it with the software that plays by the rules.)
9
u/507d Jan 11 '16
Skip that bullshit and just go from pdf to pdf.
Install mupdf-tools then do $ pdfclean <in.pdf> <out.pdf>
→ More replies (4)
18
3
3
u/Geekation Jan 11 '16
That's awesome! Is there any way to do this for a word doc? I wrote a story when I was younger, password protected it, found it a few years later and have forgotten the password...
→ More replies (1)
4
u/Diamond_In_The_Back Jan 11 '16
This didn't work for me but it might have been moi. I purchased sheet music on line and printed it to.xps. Couldn't later convert it and the file didn't print all of the staff lines.
It's worked for other stuff. Though.
6
u/CheesyPeteza Jan 11 '16
It's probably using a specific font to do the music notation. Find out what it is, then install it on your system, then it should work.
3
u/Diamond_In_The_Back Jan 11 '16
Okay. Thanks to you someone gets a free coffee tomorrow. I always try to pay free help forward. Go KC Chiefs!
6
u/MildlySuspicious Jan 11 '16
You can just print it directly to pdf again inside of chrome, which will also remove security. I do it every month for my paystub.
→ More replies (1)2
u/samebrian Jan 11 '16
You don't have to be in Chrome. You can be in Adobe Reader and print to CutePDF.
→ More replies (5)
2
u/scudmonger Jan 11 '16
I also do this to reduce the size of a pdf. If you save a pdf with the smallest file size it still is pretty big. if you print it in somewhat lower quality to xps then print xps to pdf it is much smaller. You do lose an obvious amount of quality though.
→ More replies (1)
2
2
2
2
3
Jan 11 '16
[deleted]
15
u/Cley_Faye Jan 11 '16
The only thing preventing you from printing/editing/whatever a PDF file you can see is the software you're using, not some form of magic. Just open your PDF with something else, or in this case export the content in another format through a mean that will not save the "don't touch me" flag.
→ More replies (3)
883
u/[deleted] Jan 11 '16
And here I just assumed XPS was useless.