E-book security via PDF stamping (a DRM alternative)

[ugosweb]

Hi,



I have an important question related to the security of your sistem based on stamps and watermarks on PDF to avoid from copying and deploying it on a p2p system.

I'm using an approach similar to yours for selling my ebooks on my web site since a couple of years ago. I wrote my own code in C# to add the stamps and watermarks in the ebook and I protect it by owner and reader password.

I discover that using the same API I used to add the stamps I can remove the stamps and I can copy a clear pdf without any stamp or watermark in a couple of minutes.

If it is protect by passwords (owner and user) I can use PDF Remover to remove the passwords.

After that a peice of code in C# removes the stamps and watermarks saving a clear pdf that can be easily published by a pirate on p2p system.

It is really simple.



My question is: does your system avoid from that? i.e. is your system resistent to an attack as I mentioned above? (I haven't tried to crack your pdf sample yet)

If so, I'm really happy to publish my ebooks with your system.



Regards,



Ugo Chirico

http://www.ugosweb.com

http://www.cryptware.it

[riley]

I downloaded the free test .pdf provided. There was no stamp with my name and email.

[headhunter]

Like Riley, I downloaded the test pdf provided. There is no stamp on it. I uploaded my pdf file, added the URL string, and sold a copy to myself for $0 using a discount. The delivered pdf has no stamp on it. I even uploaded a fresh copy of the pdf, waited half an hour, tried again. No go. Clearly, we're doing something wrong because I believe you guys... but what are we doing wrong?

[headhunter]

Okay, I did some experiments. The news is not good.



1. Using Adobe Acrobat 8 Standard, I set password protection on the PDF I created. The only things allowed are printing and accessibility. I uploaded it. I set URL code to http://www.e-junkie.com/ecom/oplug.php?ej_stamp_pdf=true&pdf_allow_copy=n&pdf_allow_print=y&pdf_pwd=password9. I used a discount code to buy the PDF for $0.



1.a. When clicked the download link and opened the file in Adobe Reader 9, the PDF had the stamp on it. Security on the PDF was set correctly BUT Filling in Forms was also set to ALLOWED (contrary to how I set security when I created the PDF).

1.b. I then opened the PDF in Acrobat 8 Standard (the full app). Commenting, signing, creation of template pages, filling of form fields were all ALLOWED.



2. I modified the password in the PDF to password$9 (adding a $ sign) and uploaded it again. I modified the URL string to include the new password with the $. Bought and downloaded the PDF.



2.a. The purchased PDF does not have the stamp on it. It seems the $ sign is not supported in the URL code. Security is set correctly when opened in Adobe Reader.

2.b. Security is correctly when PDF is opened in Adobe Acrobat 8 Standard. Only printing and accessibility are allowed, as I set them when I created the PDF.



3. Suspecting something odd is going on, I re-did step 1. above. I set the password back to password9 -- no $ sign. Same security settings. Uploaded the new file.



3.a. Purchased and downloaded the file the same way. Opened it in Adobe Reader 9. It has no stamp on it. Security properties are as I set them.

3.b. No difference when I opened the downloaded PDF in Acrobat 8 Standard.



My conclusion is that both the stamping feature and the security features work inconsistently.



Unless something goofy is going on on my end that I don't know about, more work needs to be done before this stamping feature will work properly and consistently. I urge e-junkie's techs to keep at it -- this is a VERY nice feature that would mean a lot. Thanks for taking on the task.

[headhunter]

I tried one more thing.



1. Using Adobe 8 Standard I removed security password from the PDF. Uploaded it. Changed the URL string to http://www.e-junkie.com/ecom/oplug.php?ej_stamp_pdf=true&pdf_allow_copy=n&pdf_allow_print=y so the &pdf_pwd= was removed (and so printing would be turned off). Bought and downloaded the PDF.



1.a. No stamp on it. Security is as I set it in Adobe Acrobat. Printing is allowed.



For what it's worth. I thought maybe the URL string would override the NO SECURITY setting from Adobe and prohibit printing. It just left the PDF as it was, made no changes. But it also did not add the stamp.



I hope this info is useful to someone.

[E-junkie_Guru]

Hm, there does appear to be an issue with the experimental new PDF stamping feature at present. We'll post an update here when it's back online.

[headhunter]

Hey, if new features worked the first time around, it wouldn't be new technology! Thanks -- I'll look for the stamping feature again. I'm new here, trying out the service. Very impressed so far. Hope to be up and selling next week! But please try to get the stamping worked out. It would make a huge difference to those of us selling valuable PDF's... and not wanting to get ripped off.

[chris_price]

I would also prefer a solution for zips;

mostly I have a mixture of pdf, doc and excel sheets.

A digital stamp for the pdsf would be enough, its ok if the docs and xls data stay without a stamp

[E-junkie_Guru]

PDF stamping does appear to be working for most files currently, although we still have not found the reason why a rare few exceptional PDF files simply fail to get stamped, so we're still looking into that. At least it's an always-or-never case for each file; if your PDF is getting stamped at all, then it should always get stamped for every checkout.



Make sure you wait AT LEAST 15 MINUTES after uploading your file before attempting any checkouts to test the stamping, as our server needs to chew on the file for a while to prepare every page for stamping with each checkout.



Sorry, it is technically impossible to stamp a PDF that is encapsulated inside a .zip archive. We can only stamp PDFs that are uploaded to us as PDFs, since we take advantage of certain aspects of the PDF file spec to perform the stamping.

[headhunter]

Tyson,



Thanks for the candid story. One question. Adobe Acrobat lets you set security across several features. E.g., you can set it to print at hi-res, lo-res, or not at all. Your settings are Y/N for printing and Y/N for copying -- those are the only settings. Acrobat lets you choose printing in hi-res or low-res. If the file is already set in Acrobat for Print=Hi-res, what happens? Do your settings over-ride the Acrobat settings?



Do your settings interfere with other security settings that Acrobat controls?



Thanks. I'm going to try again.

[fourteen40]

e-junkie test PDF displays no stamp. I think this is a great feature, I'd like to see how intrusive the stamp is.

[riley]

Got the free PDF stamp to work. Great feature. Well worth the price of admission.



Now am having a problem stamping my file. I have gone through the checkout discount process but my downloaded file is not stamped. I uploaded it a few days ago so it has been "chewed on" by your server. There is no password for my file. Is this the problem? I don't want to have to have a password for my buyers to open the pdf.



Thanks for the effort.

[E-junkie_Guru]

Hm, it should be working now for most PDFs, no password should be necessary. Try this: Go back to the first post in this topic and right-click on the Payment Variable Info URL provided there to copy the link target/location, then repaste that into your PDF product's settings (and remember to remove &pdf_pwd= from the end if your file has no password) and click Next then Submit to save changes; then edit your product again and use the Overwrite Product File button to reupload a fresh copy of your PDF, and click Next then Submit again. Wait at least 15 minutes, then try a test checkout again to confirm the file gets stamped.

[riley]

Still doesn't work. Repasted the url link and saved changes. then uploaded a new pdf and saved changes. waited an hour then downloaded a discounted free pdf from my site using the add to cart button. Is it the pdf file itself? or the process? should I try it with a diferent pdf from a different source?



thanks

[riley]

Its the pdf file itself. I uploaded a different pdf from a different source and it worked. my first pdf was created with an aftermarket pdf program called PDFtypewriter. the second pdf file I believe was created with Adobe. I will test other pdfs from other sources. Can you look at the file I created with PDFtypewriter and see if you can get it to work. It is a much cheaper alternative to me having to buy Adobe.



Thanks

[headhunter]

I use Adobe Acrobat 8 Standard. The stamping still doesn't work if I keep a security password on it.

[E-junkie_Guru]

Please email support with the PDFtypewriter version of your PDF file attached for testing:

https://www.e-junkie.com/ej/contact.php



Also, see if there may be some settings in that PDFtypewriter program that somehow locks the files it produces, prevents alteration, or perhaps adds some sort of authoring password to the file that you may not have been aware of.



@headhunter:

Are you specifying your author password in the URL? The read-only password for buyers will not work for this purpose.

[headhunter]

Tyson: I'm starting to think the problem is semantics. (I hope so, because then I can start stamping!)



There is no password to open my document (aka, Document Open Password, aka User Password). Anyone can open it.



What I have set is a Permissions Password (aka, Master Password) that prevents copying text, editing the doc and extracting pages.



To make sure we're talking about the same thing, in Acrobat's Doument Properties/Security tab, I select Password Security. Within that section, I check "Restrict editing and printing of the document" then permit printing (hi-res) and the "accessibility" option, but prohibit page extraction, copying text, etc.



That's the password I have.



1. When I set the URL in e-junkie so I can stamp, should I even include that password?



2. Do the Y/N settings in your URL supersede my Permissions password?



Thanks again. BTW, I took my PDF product live this morning, sales & payments went off without a hitch. PayPal plays nice with e-junkie. Even my lawyer is impressed! My first time with you guys -- good experience.

[riley]

I got it to work thanks. I removed all security type settings or encoding and just made a plain pdf. The plain PDF was stamped. Since I dont need a password for my pdf this works fine. Thank you

[headhunter]

Riley, I got that to work, too, but I need some protection on my product (PDF).