Author Topic: sharing document securely?  (Read 3828 times)

scrubbyfish

  • Guest
sharing document securely?
« on: December 17, 2015, 05:10:10 AM »
For those of us without tech savvy, access to Corporate fanciness, etc, is there a way to share a document with select people in far off lands in such a way that the doc cannot become accessible (viewable, printable, etc) by others?

arebelspy

  • Administrator
  • Senior Mustachian
  • *****
  • Posts: 28444
  • Age: -997
  • Location: Seattle, WA
Re: sharing document securely?
« Reply #1 on: December 17, 2015, 05:21:44 AM »
Do you trust the other people with it, or do you want them to only be able to view it, but not print it?

A locked PDF (with password to access, and print abilities disabled) would fit the bill.

Or (if the answer to the first question is yes), just zipping your file up with a password is the easiest, IMO.
I am a former teacher who accumulated a bunch of real estate, retired at 29, spent some time traveling the world full time and am now settled with three kids.
If you want to know more about me, this Business Insider profile tells the story pretty well.
I (rarely) blog at AdventuringAlong.com. Check out the Now page to see what I'm up to currently.

Tjat

  • Pencil Stache
  • ****
  • Posts: 570
Re: sharing document securely?
« Reply #2 on: December 17, 2015, 06:27:47 AM »
I like Google Docs. You can set just yourself or any number of people as editors, allow read only access to others, etc.

sisto

  • Handlebar Stache
  • *****
  • Posts: 1084
  • Age: 55
  • Location: Sacramento, CA
Re: sharing document securely?
« Reply #3 on: December 17, 2015, 09:21:40 AM »
+1 to what Arebelspy said.

Beaker

  • Bristles
  • ***
  • Posts: 334
Re: sharing document securely?
« Reply #4 on: December 17, 2015, 09:36:37 AM »
There's a tradeoff between security and ease-of-use, so it depends what you're trying to protect against. Snooping housemates, casual hackers (script kiddies), serious hackers that are targeting you personally, Google reading over your shoulder, something else?



Cathy

  • Handlebar Stache
  • *****
  • Posts: 1044
Re: sharing document securely?
« Reply #5 on: December 17, 2015, 09:50:32 AM »
...print abilities disabled...

If somebody can view a document on their computer, they can also print it. That proposition is true as a matter of pure logic and does not depend on the details of the technology involved. Here's one argument to convince you that this is true: If you are viewing a document on your monitor, there must be some physical process taking place in the computer that is able to translate the "secure" data on disc into a set of coloured pixels to display on the screen that represent the document. At that point, the data has been revealed, and nothing stops you from swapping out the screen and sending the array of pixels to the printer instead. Your immediate response might be that that only lets you print the first page, not the entire document, but the mechanism of scrolling the document isn't magic -- if you can do it with your mouse, you can also do it with a machine. So it is indeed possible to print the entire document in a fully automated fashion, if you can view it.

Attempting to prevent somebody from printing a document that they can view on their own computer is an example of pseudo-security rather than actual security. And, as a consequence of the foregoing, the Adobe PDF restrictions on printing do not actually work once the person has unlocked the document; at that point, the person can easily print the document through any number of means. (The easiest way would be to just use a PDF reader that does not enforce the printing restrictions!)

That said, attempting to prevent somebody from viewing the document by encrypting the data in transmission and at rest is an example of actual security, and the Adobe PDF password mechanism is a good implementation of that, so I still recommend using that mechanism -- just don't expect it to stop people from printing the document once they can view it.
« Last Edit: December 17, 2015, 09:53:33 AM by Cathy »

Jack

  • Magnum Stache
  • ******
  • Posts: 4725
  • Location: Atlanta, GA
Re: sharing document securely?
« Reply #6 on: December 17, 2015, 09:54:22 AM »
Do you trust the other people with it, or do you want them to only be able to view it, but not print it?

A locked PDF (with password to access, and print abilities disabled) would fit the bill.

It's worth mentioning that trying to "partially trust" the recipient is inherently futile. If you give the recipient enough information to view the document at all, you have necessarily also given him enough information to copy or print it too. Even if the viewing software tries to restrict the functionality (like Adobe Acrobat) does, the recipient could use some other software that's not restricted. Even if he doesn't have said software, he could still take a screenshot. Even if the viewing software disabled the operating system's ability to save screenshots, he could still take a photo of his monitor.

In other words, disabling print in a locked PDF is pointless: it annoys authorized users, while failing to deter attackers. In fact, it's worse than useless because it fosters a false sense of security.

My recommendations:

  • If you can send the key over a side-channel (e.g. phone call) then zip with a password, or use Adobe's "locking" function (but don't bother to try to restrict people who have the key).
  • If no side-channels are available, or you need authentication (i.e., the recipient needs to be able to verify that it was you, and not somebody else, who sent it), look into GPG. Details of how to use that are well beyond the scope of this comment.
  • If you want control over what the recipient does with the document, don't let him have a copy. Instead, make him come to a location you control and supervise him while he reads it so he doesn't surreptitiously make a copy.

Edit: Damn, AI robot Cathy beat me to it!
« Last Edit: December 17, 2015, 11:27:22 AM by Jack »

arebelspy

  • Administrator
  • Senior Mustachian
  • *****
  • Posts: 28444
  • Age: -997
  • Location: Seattle, WA
Re: sharing document securely?
« Reply #7 on: December 17, 2015, 10:10:43 AM »
I didn't think that needed to be said, but thanks for the clarification.  :)
I am a former teacher who accumulated a bunch of real estate, retired at 29, spent some time traveling the world full time and am now settled with three kids.
If you want to know more about me, this Business Insider profile tells the story pretty well.
I (rarely) blog at AdventuringAlong.com. Check out the Now page to see what I'm up to currently.

scrubbyfish

  • Guest
Re: sharing document securely?
« Reply #8 on: December 17, 2015, 10:47:26 AM »
Very helpful! Thank you very much, all!

seattlecyclone

  • Walrus Stache
  • *******
  • Posts: 7254
  • Age: 39
  • Location: Seattle, WA
    • My blog
Re: sharing document securely?
« Reply #9 on: December 18, 2015, 11:47:47 AM »
For those of us without tech savvy, access to Corporate fanciness, etc, is there a way to share a document with select people in far off lands in such a way that the doc cannot become accessible (viewable, printable, etc) by others?

Depends what you mean by "others." Google Docs (or similar services from Microsoft and others) will offer you the ability to control which users of the service can see your file. I generally trust them to keep their systems secure from outsiders about as much as is humanly possible. However, while these systems are rather secure from outside access, there will be certain employees of the company running the service who will have the technical ability to read your document. In general, the only time this ability would ever be used without your explicit permission would be in response to a court order. I'll leave it to you to decide how much you want to worry about this possibility with the document in question. If you do want to ensure that your document only can be read by the intended recipient (and not law enforcement or anyone else running the system that stores your document), you will need to encrypt it on your end. Then you have to find a secure method of sending the encryption key to the people in "far off lands". Putting it in an email just shifts the sensitive information from Google Docs to Gmail, which probably isn't any better from a privacy perspective.