PDF DRM protection

We have a shopping cart in place to sell ebooks in pdf file format. The shopping cart (Lexiconn shopsite) provides the ability to restrict printing of the file, # of download attempts, and will send the URL to the customer automatically. What we need is a way to protect the file from being copied and opened from a different PC and/or by a different user.  Does anyone have suggestions on what type of software solution would work best? Is there anything out there that would interface with our current e-commerce solution?

As an aside, we are also looking for a software solution for copy protection of CD-Rs and DVD-Rs masters,  as well as protection of e-streaming video.

Take a look at HYPrPDF
<url>http://www.hyprlock.com/hyprlock/index.htm</url>

The main problem with PDF protection is that unless you are willing to budget around $45K USD for Adobe's server program for PDF security you probably won't be satisfied with the standard Adobe security. Verify this for yourself by searching for progrms to defeat PDF security.

HYPrPDF uses the orginal PDF security, but it is shrouded by Activ's security.

Lock Lizard is a fine solution if you don't mind being tied forever to an online service that charges monthly service fees. Unfortunately, like many similar solutions, it only protects distribution. That means PDF password recovery programs can easily steal your PDF content.

HYPrLock/HYPrPDF, on the other hand, not only protects the distribution of your PDF file it also protects the contents. It prevents Password Pirates and PDF hackers from editing, copying, or un-authorized printing and makes "brute force" attacks virtually impossible.

The level of protection offered by HYPrLock is above and beyond programs like Lock Lizard and HYPrLock's one time purchase price of $49.95 make it a lot less expensive.

we looked into many, many products before selecting FileOpen as our ebook DRM solution.  We chose them based on their ability to integrate with our ecommerce solution, the fact that they handle pdf files only and are an Adobe partner, the user friendliness of the utility and the ebook ordering and opening process from the customers prospective, their agreement to write any needed perl or php scripts to integrate with our cart and lastly based on cost.

A close second behind FileOpen in our opinion was Crypkey. Equal to FileOpen's solution on most counts except for the fact that they are not affiliated with Adobe and don't soley focus on pdf files.  A plus with this solution is that they handle all file types, even protection of videos...  The cost was the same.  We chose FileOpen over CrypKey because of their affiliation with Adobe and their client list, which consisted of many top publishers.

We looked into LockLizard, Hyperlock, LinkData, Adobe, and a number of other solutions, but based on the details of our ecommerce solution, the number of titles we needed to protect, our budget, and the fact that we wanted customer information on our server...we chose FileOpen.

You might want to reconsider your use of FileOpen.

1) There is H acker software available on the web to bypass the FileOpen security system.

2) FileOpen is a subscription driven, online monitoring service.

3) The FileOpen system only protects PDF distribution not PDF content.

Ron

---

---

Unfortunately, like many similar solutions, it only protects distribution. That means PDF password recovery programs can easily steal your PDF content.

---

What do you mean by this? Have you ever checked LockLizard ? All protected files are distributed in .pdc format and not common pdf format, there is practically nothing you can do about it to make those work in PDF password recovery programs.

What do you mean that similar software do not protect PDF content?

Thanks for bringing the new LockLizard PDF security system to my attention.

Times change and my post from a year ago about LockLizard PDF security may no longer be completely accurate. However, at this point, LockLizard's PDF security claims are difficult to prove and mostly irrelevant.

To potentially achieve the same level of security as HYPrLock's $49.95 software, LockLizard now costs a whopping $2495.00 yearly. If an author wants a "perpetual" license for their own server (standard with HYPrLock) the cost climbs to $6495.00. If an author wants ecommerce integration or their own branding (standard with HYPrLock) the costs keep going up. I suspect few eBook authors will be able (or want to) afford the LockLizard solution.

It should also be noted, with LockLizard, you must distribute a special viewer for their exclusive PDC format -- HYPrLock still uses the well known PDF format and the universal Adobe PDF Reader.  

Will anyone pay $2495.00 yearly for the same level of PDF protection they can get for a one time cost of $49.95? Somehow I doubt it.

---

---

However, at this point, LockLizard's PDF security claims are difficult to prove and mostly irrelevant.

---

It's almost always the case because ebook authors are not security experts and it's not easy to pick the best choice. There are a lot of websites advertising
protection systems with computer terminology and fancy terms  which are only partially true or only limited knowledge of the author. I remember  
a claim like this "Our protection system DOES not store unprotected copy of pdf
into temporary folder."  They were right no files were stored in a temporary folder, BUT all unprotected files were stored in a system folder.
What an improvement.

Downloading a special viewer , may be a nuisance but LockLizard knows very well what they do. Unlike opening a pdf with whatever more or less reliable
software customer has installed, LL Viewer is a safely controlled enviroment  designed also to protect the files.

Comparing your system to locklizard is a very daring comparison.

No matter how you spin it.. The HYPrLock security system provides unlimited eBooks with maximum PDF security for only $49.95

Experts agree that using Adobe's 128 bit encryption, and long strings of random alpha/numerals for both the OWNER and USER passwords is virtually un-cr-ack-able by anyone. Even Elcomsoft, recognized as the ultimate program for breaking PDF security, can not cr-ack HYPrLock security (even using "brute force" and thousands of years).

HYPrLock is not an average security system. It controls both the OWNER and USER passwords "on the fly". No one (not even the PDF author) has access to these "invisible" passwords or can open a HYPrLock protected PDF file outside of the HYPrLock system. HYPrLock security, working in tandem with Activ E-Book, locks each PDF file to one customer and one computer. PDF/eBooks cannot be copied, modified, or shared.

Making misleading statements about other questionable security companies or mentioning unprotected files in "Temp" folders is just a blatant attempt to cloud the issue and does not apply to HYPrLock. HYPrLock even provides a "demo" PDF file so that anyone can download and "test" the system for themselves. HYPrLock does not use confusion as a promotional tool - like some software security systems do -- and doesn't need a special viewer.

If you look at excelsoftware's link to "DocProtect" -- you will see another security system that tries to cloud the security issue. DocProtect might be cheaper than LockLizard but not much -- and you will not find any explanation of how they secure PDF content. All they seem to be promoting is a security "distribution/delivery" system. In fact, the Excel Software system doesn't provide any more security than HYPrLock and Activ E-Book and it costs hundreds of dollars more. One unique claim it has going for it is the ability to work on a Mac -- but with many Mac users loading a Windows emulator on their machines -- so does HYPrLock :-)

One feature that seems to be lacking from both LockLizard and Excel Software is the ability to protect distribution CD's without needing expensive anti-copy software. With HYPrLock security you can distribute PDF/eBook content on a CD from 3rd party distributors, eBay or by hand at your local mall -- with automatic locking of one customer and one computer.

With HYPrLock, PDF/eBook authors automatically get a "lifetime" DRM security system -- including download and distribution security, monitored software access,  resettable "instant" refund control, automatic password distribution, a secondary "viral" ordering system, Ultra PDF security and (of course) secure CD distribution. All without additional charges or monthly fees.

LockLizard can make claims of being "the most expensive" but that doesn't means it's better.

---

---

No matter how you spin it.. The HYPrLock security system provides unlimited eBooks with maximum PDF security for only $49.95

---

Your claim about MAXIMUM pdf Security is not true.

---

---

Experts agree that using Adobe's 128 bit encryption, and long strings of random alpha/numerals for both the OWNER and USER passwords is virtually un-cr-ack-able by anyone. Even Elcomsoft, recognized as the ultimate program for breaking PDF security, can not cr-ack HYPrLock security (even using "brute force" and thousands of years).

---

That's true but elcomsoft does not cra*ck
HYPrLock security but pdf security.

---

---

Making misleading statements about other questionable security companies or mentioning unprotected files in "Temp" folders is just a blatant attempt to cloud the issue and does not apply to HYPrLock. HYPrLock even provides a "demo" PDF file so that anyone can download and "test" the system for themselves. HYPrLock does not use confusion as a promotional tool - like some software security systems do -- and doesn't need a special viewer.

---

My "misleading" statement was just an example of how other systems are promoted, has never been intended to be linked with hyperlock.

---

---

If you look at excelsoftware's link to "DocProtect" -- you will see another security system that tries to cloud the security issue. DocProtect might be cheaper than LockLizard but not much -- and you will not find any explanation of how they secure PDF content. All they seem to be promoting is a security "distribution/delivery" system. In fact, the Excel Software system doesn't provide any more security than HYPrLock and Activ E-Book and it costs hundreds of dollars more. One unique claim it has going for it is the ability to work on a Mac -- but with many Mac users loading a Windows emulator on their machines -- so does HYPrLock :-)

---

I do not know how much security it provides. They do not list any security feature on their page, what's even worse
there is no trial or demo version to try. It's like buying car with promise that under the hood is certainly some engine.

---

---

One feature that seems to be lacking from both LockLizard and Excel Software is the ability to protect distribution CD's...

---

I would not call it 'lacking'. Just because you decided to include CD distribution protection does not mean that other systems lack it.

You refute my claim about MAXIMUM pdf security --

What leads you to that conclusion?
Have you tested HYPrLock's PDF security?

HYPrLock enforces the "maximum" protection provided by the Adobe PDF "OWNER/USER" password format.
Any additional security provided by external software is "distribution" security and is unrelated to PDF "content" security.

*Most claims of PDF security refers to "distribution" security (where only access to the PDF file itself is controlled).

In any case I'm not saying that LockLizard (or even DocProtect) doesn't provide a high level of PDF security -- it's possible that they do. However, unless they provide both "content" and "distribution" security, the level of security is questionable. HYPrLock does provide both "content" and "distribution" security and I think that combination means the HYPrLock Security System is ultimately better than LockLizard or DocProtect.

We might quibble about how many thousands of years protection HYPrLock or LockLizard provides but for me it's question of value. No doubt your "most expensive" status will attract large corporations and big government spenders with unlimited budgets but my software was designed for regular PDF/eBook authors.

All things considered, PDF/eBook authors will decide if they'd rather buy HYPrLock's system at $49.95 for "Perpetual license - hosted on the customer's server" or LockLizard's comparable service for $6495.00+. Seems like a "no brainer" to me.

BTW: My claim about elcomsoft protection DID refer to HYPrLock's "PDF" protection.

BUT it does not change the fact that 128 bit is still secure enough to protect pdf as all the experts, you are always referring to, claimed 8 years ago.

Whether is hyprlock better than locklizard is highly disputable, I have my choice. As for DocProtect
there is total lack of information to make any comparison.

Obviously you have not been doing your homework...

A quick Google search on Adobe's 256 bit encryption will turn up information showing Elcomsoft's (the recognized authority on breaking PDF security) claim that Adobe's new 256 bit encryption algorithm is 100 times easier to break that the older 128 bit encryption.

Due to this increased security risk, HYPrLock does not and will not adopt the new Adobe 256 bit encryption model.

[color=darkblue]Many pundits believe that Adobe's move to 256 bit encryption was just a blatant ploy to sucker users into a new, unnecessary, purchase. What better way to justify a new version (and make more money) than to make false claims of improved security. [/color]  

As you pointed out, experts still agree that Adobe's double (OWNER/USER) password system using 128 bit encryption is virtually uncr*ackable ([color=darkblue]as long as both passwords are long alpha/numerical strings and both passwords remain secure[/color]). This is the system that HYPrLock uses --
so HYPrLock's claim of maximum security stands -- unrefuted.

[color=darkred]If LockLizard wants to adapt the weaker 256 bit security standard that's their problem.[/color]

You seem unwilling or unable to distinguish the difference between "distribution" security and "content" security. I define "content" security as the security provided by Adobe's internal features -- these protect the "content" by preventing copying, editing, or printing of the PDF file. These Adobe security features are displayed in (for example) the Adobe "Reader" program ([color=darkred]LockLizard users must supply a special LockLizard PDF reader[/color]).

Most PDF security systems only provide "distribution" security. With these systems (no matter how much they protect access to the PDF file itself) they must ultimately give the customer a "USER" password -- so the customer can open the PDF file and read it. As soon as a PDF password is released to the public, the PDF "content" security potentially falls to zero and ha*ckers can remove all security features with programs like elcomsoft.

An explanation of this problem is outlined in this security document from the Carnegie Mellon School of Computer Science.
PDFsecurity.pdf

With the HYPrLock system, not only is the "distribution" system secure and locked to one customer and one computer, but no one ever gets access to the "OWNER/USER" passwords (no one even sees the passwords). Therefore passwords can never be shared with family, friends or PDF ha*ckers.

To prove you wrong, my claim of HYPrLock superiority hinges on the fact that HYPrLock programically generates the OWNER/USER PDF passwords "on the fly" so they remain completely hidden and inaccessible from everyone. The PDF "content" always remains secure because only the HYPrLock program can open a HYPrLock protected PDF file.

In other words, your claim about 128 bit pdf protection and MAXIMUM security adobe offers right now is TRUE.

You define "content" security as the security provided by Adobe's internal features.
What if someone creates a viewer for their special pdf protected document which automatically
implement all these on EVERY document regardless of actual pdf standard settings plus adds some custom
ones, like screenshot protection? That's why are custom viewers valuable, they can be further customized, improved.
You can still call this "no content" protection, just because it does not fit your description even if it's obviously not true and content may be protected even better way.

As for the user password, there are no user passwords at all in locklizard as in other similar systems, there are only decryption strings invisible to customer , even if they were visible there would be no way they can be used because there is no place to be entered by user manually in the customized viewer , unlike simple password dialog in common viewer.

I ask you what would happen if your customer gets a hold of a password for hyprlock document? How far is he REALLY from having unprotected document? Answer honestly. ....not very far....

What will happen when the user get a hold of "password" for locklizard or similar systems? Simply nothing. There is practically nothing he can do with it.

I can see how the LockLizard system could be potentially as secure as the HYPrLock "content" protection but both systems approach "content" security in different ways. LockLizard's solution uses a complicated process that "remasters" the PDF document into a different and exclusive digital format. HYPrLock's exclusive "invisible" PDF passwords system is a simpler and more direct solution.

To imply that a HYPrLock protected PDF file is less secure because the LockLizard software "hides" it's controls is ridiculous. Like lockLizard, HYPrLock automatically implements full PDF protection and provides additional security features. Also like LockLizard, HYPrLock does not require or allow customers to enter a PDF password. However, we both know that ALL security systems are vulnerable to a determined software cr*acker. Both programs may have (so called) screenshot protection but they are still vulnerable -- how do you protect against a digital camera?

We both also know that if a PDF file is displayed on a computer screen and it can be read, it is vulnerable to pirates. I suspect the best way to defeat both of our security systems is with a pen and paper. All it takes is time and determination.

You ask what would happen if a customer gets hold of a password for a HYPrLock protected document -- These passwords are created "on the fly" within the program at run time... An experienced cr*acker (that can "sniff" Windows internal operating memory while a program is running) -- might be able to do that -- but I doubt anyone that good would waste his talents on a PDF file. He'd probably be breaking into a bank or the Pentagon.

Yes I am assuming and generalizing the weaknesses of other systems and comparing them to HYPrLock. You do the same with LockLizard. We both want potential customers to compare our products and choose what "we think" is the best choice.

The difference is that HYPrLock is just as good or better than LockLizard and only costs $49.95. LockLizard on the other hand may be just as good or better than HYPrLock and it costs $6495.00. HYPrLock offers additional features like CD distribution security and LockLizard requires a custom viewer.

The real question is "What does LockLizard offer that is worth an extra $6445.00"?

Ron

I'm in the last stages of writing an E-Book and I want to protect my book completely. There are solutions that package your E-Book as an exe file however this limits you to only Windows users and a smaller percentage of Mac users who have a windows emulator like Parallels etc

Is there a web-based application that provides full or pretty good PDF security that is browser based? I want to prevent theft, track who opens the file and prevent printing and copy paste etc. And also being web-based I can accommodate both PC and Mac

Hi
I would like to know about your experience so far with FileOpen. Is it working for you?