Canva strips security from any locked PDF file - any solution

[nosarengonikkitikkitengo]

Background:

We supply PDF files to our client. Sometimes they like to make their own amends to these. The problems are obvious - our projects get re-appropriated for other use, the quality of the images, colours, and design is lost (images become mush, typographic formating lost), and we lose an editable master copy - so whenever we have to make amends which the client cannot, we have to trawl through their Canva edited file to find the amends they have made and apply them. Furthermore, the Canva version looks terrible which makes our work look bad - a business risk.

The problem:

I thought that providing the pdf with editing prohibited - no changes, no copying of text / images / no access for screen readers etc - all denied would fix this problem. However, when we tested this - bringing in this locked pdf into Canva it becomes fully editable.

Solution?

Apart from this being a massive security issue - where seemingly any copy within a locked pdf can be freely changed, is there another solution where the file can be locked down? canva will not import a password protected pdf, however that is not a solution as the files we supply need to be distributed.

Many thanks for help.

[Abambo]

You should ask this in a Canva forum.

I do not know how you can protect a file from modification, if you can't password protect it.

[nosarengonikkitikkitengo]

I am asking here as the subject is about preserving the security of the Adobe PDF file.

I doub't the Canva community would promote and participate in the limitation of their own platform.

[Abambo]

There is no such thing as an Adobe PDF file. Even that Adobe developed the PDF file format, it is now an ISO standard, and Adobe is no more responsible for the format. Whatever Canva does, it is in Canva's interest to follow-up the standards.

[nosarengonikkitikkitengo]

The issue is that i CAN password protect the PDF file from modification.

But Canva can strip that protection, and the file can be modified.

[Abambo]

There is nothing that can be done about that. How does Canva strip the password protection? As there are tools out to unprotect PDF files, most of them are doing a brute force attack. That fails, as long as the password is sufficiently complex. But as the file can be read without a password, a modify protection is only as good as the tools that can be used.

[MikelKlink]

First of all, PDF is a publicly specified file format, so anyone who can view it also can technically manipulate it. The mechanism you mention, the permissions, essentially only are hints to cooperative software. The PDF specification already mentions this, once the document has been opened and decrypted successfully, a PDF reader technically has access to the entire contents of the document. There is nothing inherent in PDF encryption that enforces the document permissions specified in the encryption dictionary.

What you can try, though, is digitally signing the PDFs before giving them to the client, and communicate that you accept only versions of the PDF with the signature still present and valid. 

[nosarengonikkitikkitengo]

The solution to the question I asked, is to convert all copy to outlines in the print production tool within Acrobat - the text cannot now be edited in any application other than at source - in InDesign.

[Bernd Alheit]

You can't restrict this with outlines. 

[MikelKlink]

The solution to the question I asked, is to convert all copy to outlines in the print production tool within Acrobat - the text cannot now be edited in any application other than at source - in InDesign.

That's overly optimistic.
But it indeed makes sure that edited versions will look even worse... 😉 

[nosarengonikkitikkitengo]

It has been tested and it works. The text can no longer be edited - which was the objective. The result does not look worse. The aim was to prevent the client from editing the pdf using Canva, or anything altogether, which this achieves.

[MikelKlink]

It has been tested and it works. The text can no longer be edited - which was the objective. The result does not look worse. The aim was to prevent the client from editing the pdf using Canva, or anything altogether, which this achieves.

Of course there is no text anymore. Thus, you cannot edit text as such. But you can simply use tools like rubbers, color-fill, or area-copy to wipe out existing text and then write your own text over it.

I don't know Canva, so I cannot tell whether it offers such tools, but if your clients are determined and not dumb, they'll find out sooner than later that they can easily manipulate your new PDFs like that. You merely push them from text editing to graphic editing which will leave even funnier artifacts than before.

Also there are OCR programs that create fonts from recognized text, making text editable again. So using such an OCR program first, your clients may even continue text editing, merely with a deteriorated quality.

But if your clients are not so determined or not so bright, then you indeed may have found a solution for your problem.

[Bevi Chagnon - PubCom.com]

As mentioned earlier (or in a similar thread you started), anyone can take your PDF with the outlined text and run it through an OCR program (Acrobat, Abbyy FineReader, etc.), and end up with live text and graphics to edit. Depending on how long the document is, takes anywhere from 1-3 minutes.

Your client is looking for a way to circumvent using your services to make changes to the original design. In time, they'll find a way to do this, regardless of what you do to prevent it. The PDF file format is an open standard available to any company that wants to make tools to create, edit, render, process, or distribute PDFs.

From day one, PDF has never been a secure file format, and no one has yet invented a method to prevent a PDF from being edited or tampered with.  It's the nature of the file format itself. (Note, I'm a US delegate to the ISO committee that writes the PDF standard, ISO 32000.)

I like the suggestion above to put a digital signature in your file, maybe on the pasteboard. That can put a higher level of security into the PDF file that hopefully, Canva and other tools would respect. But then again, there's no guarantee about that.

Adobe's advertises that PDFs can be secured is pure BS. So many programs on the market can bypass that low-level security setting.

I think your client is sending you an indirect message: your not giving them everything that they need. Eventually, they'll find a way around you and maybe ditch your studio altogether.

As a fellow studio owner, I'd spend my time figuring out what my client needs and find a way to provide it to them. Maybe approach them with special pricing for your studio to make the changes for them within a set period of time, like 48 hour turnaround time. That keeps you in charge of the file, and the client realizes they need your skills.

Also tell them that when they muck around in a PDF on their own, they can damage the file and make it impossible for your studio to work with it in the future. Tell them in advance that the damage might require you to substantially rebuild or fix the mess they made...before continuing with the revamped design.

[nosarengonikkitikkitengo]

Yes, I've told them that. There are just a couple of 'problem people' in this organisation who try and save a couple of $ which is a false economy as when a serious update is required, we need to make those amends anyway. The people that have been doing this are junior level. We are not being sent any 'indirect messages'. There's no need to go into details on busines models etc, as our practice is sound - we are not getting ditched by anyone. The requirement in the original post was to add the element of prevention to these junior staffers. This is acheived. Case closed.

[Abambo]

Yes, I've told them that. There are just a couple of 'problem people' in this organisation (...) The people that have been doing this are junior level. (...)The requirement in the original post was to add the element of prevention to these junior staffers. This is acheived. Case closed.

By @nosarengonikkitikkitengo

It's a matter of negotiations and trust. More often than not, you do not talk to the junior level people in an organization, but to people who, according to the importance of the project, make the decisions. I get what I want, the agency gets what they want, my CEO gets what they want. And the junior staffers do as they are told to do. 😉

[Abambo]

The solution to the question I asked, is to convert all copy to outlines in the print production tool within Acrobat - the text cannot now be edited in any application other than at source - in InDesign.

By @nosarengonikkitikkitengo

I'll take your asset in Acrobat, delete what I want to delete and add what I would like to add. Or I put it as a picture in InDesign and add what I would like to add. Or I open in Illustrator and do what I want to do.

It is an error to think that someone scrambles the fonts to outlines, that you can't edit. I can even reconstruct the text if it pleases me.

I'm with you on the fact that, when the client alters the asset, they tend to wreck a well-organized one, especially if they're novices. But that's something you need to discuss with your client. In the end, the customer is king. I would ask for the full InDesign files btw. I did in multiple circumstances, and only when I was not involved in the negotiations, I did not get the assets in the form I needed them to modify them correctly.

[nosarengonikkitikkitengo]

"I'll take your asset in Acrobat, delete what I want to delete and add what I would like to add. Or I put it as a picture in InDesign and add what I would like to add. Or I open in Illustrator and do what I want to do."

You can't do that - because the PDF permissions work in Adobe applications.

[Abambo]

You can't do that - because the PDF permissions work in Adobe applications.

By @nosarengonikkitikkitengo

😉 Yes.