Issue 116580 - PDF Password not memorised (not even while still open)
Summary: PDF Password not memorised (not even while still open)
Status: UNCONFIRMED
Alias: None
Product: gsl
Classification: Code
Component: code (show other issues)
Version: OOo 3.3 RC1
Hardware: PC Windows, all
: P3 Trivial with 2 votes (vote)
Target Milestone: ---
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-01-24 07:18 UTC by marwerno
Modified: 2013-02-07 22:41 UTC (History)
1 user (show)

See Also:
Issue Type: ENHANCEMENT
Latest Confirmation in: ---
Developer Difficulty: ---


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description marwerno 2011-01-24 07:18:38 UTC
When exporting a PDF I have the option to set a open password and a permission 
pass word.
I set the pass word and export the PDF.
Now, if I want to export the same document again, without closing it (i.e. 
different range of pages, different layers in Draw) the pass word needs to be 
entered again! 

1: 
The pass word should definitely not be lost for as long I have the document 
still open!

2: 
I would be beneficial if the password would be stored in the document, so the 
export could be quickly done by pressing the PDF export tool bar button instead 
of going trough the dialogue.

Point 2 also partially requires issue 50974 to be implemented. It is not the 
same issue, but probably very related to each other.

If pass word storage in the PDF is an issue, I have to say this:
What is more "dangerous":
A local file where a pass word might be read out from
or
A file, possibly in the public domain, that was sent out without pass word 
protection since the user assumed the pass word he entered the first time in 
the PDF export dialogue to be memorized.

3:
The password should be displayed in plain text. There is no need for secrecy 
when creating the pass word!
Also saves on typing the pass word twice (especially if the other points would 
not be implemented and you have a long pass word)

Thanks for taking this on.
Comment 1 philipp.lohmann 2011-01-24 10:19:43 UTC
A question for user experience.

Let me comment on your points:

1. the password should not be stored (clear text passwords should not be kept
anywhere longer then necessary), but it might be worthwile to store the
encryption keys in memory while the document is open. They are after all also in
the produced PDF. We would need to change the UI however so that the user gets
informed prominently that his PDF gets encrypted on the second export, even
though he did not enter a password. E.g. one migth show a "lock sign" in the
dialog on all tab pages to indicate the exported PDF gets encrypted.

2. "A file possibly in the public domain because the user assumed the Password
would still be set". Please, nothing is ever going to protect documents from
user error; if someone sends out sensitive documents without checking they are
actually encrypted, no amount of programming will protect against that.
Passwords should only be stored persistently if there is an actual benefit and I
don't quite see it here.

3. No, a password should not be displayed in clear text. Unless you absolutely
want to tell the password to the guy setting next to you in which case you can
easily tell him.
Comment 2 marwerno 2011-01-24 23:28:53 UTC
Thanks for your comments, some additional information from my side to these 
points:
1:
I guess this is something most people could agree on, there is no harm, only 
benefit to this. I agree that the user should have some form of information 
about the status of his document, also see 2.

2:
How about making a check box in the Export settings that says: "Store PDF 
Password in document" (Which would also work for point 1) in this way the user 
has the option, everybody is happy.
(And yes, there is always the weak point of some (stupid) user, I just try to 
reduce it)

3:
If somebody is sitting right next to you, he probably has access to the same 
network resources as well and might very well have access to the original file. 
If he really sits right next to you he also sees what you are typing on your 
keyboard, therefore still the same issue (and he has 2 chances seeing you type 
it). 
The open source "PDFcreator" PDF Printer now shows the pass word and you have 
to type it only once  (only lately, they used to have it like OO). 
They seemed to have enough feedback without safety concern to change it that 
way. (I used to use them, but since OO 3.3 the PDF export works very well with 
Draw (THANKS!) with much smaller file size using OO compared to PDF creator)
Anyway, point 3 will turn very minor if point 2 would be implemented.

thanks
Comment 3 marwerno 2011-01-24 23:38:21 UTC
Forgot to write:
2: If default on check box is "off" OO would behave like it always did and nobody 
would be surprised by different/ unexpected behaviour.