Prevent PDF file from downloading and printing

by

Okay, I take back what I commented earlier. Just talked to one of the senior guys in my shop and he said it is possible to lock it down hard. What you can do is convert the pdf to an image/flash/whatever and wrap it in an iFrame. Then, you create another image with 100% transparency and lay it over top the iFrame (not in it) and set it to have a higher Z-value than the iFrame.

What this will do is that if they right click on the ‘image’ to save it, they will be saving the transparent image instead. And since the image ‘overrides’ the iFrame, any attempt to use print screen should be shielded by the image, and they should only be able to snapshot the image that doesn’t actually exist.

That leaves only one or two ways to get at the file…which requires digging straight into the source code to find the image file inside the iFrame. Still not totally secure, but protected from your average user.

More Related Contents:

  1. How do I create a self-signed certificate for code signing on Windows?
  2. What is token-based authentication?
  3. JWT refresh token flow
  4. Cross Domain Login – How to log a user in automatically when transferred from one domain to another
  5. Where do you store your salt strings?
  6. How can I throttle user login attempts in PHP
  7. Why is using a Non-Random IV with CBC Mode a vulnerability?
  8. Best Practices: Salting & peppering passwords?
  9. Is it safe to put a jwt into the url as a query parameter of a GET request?
  10. What’s the right OAuth 2.0 flow for a mobile app
  11. How do I store and retrieve credentials from the Windows Vault credential manager?
  12. MVC 6 Bind Attribute disappears?
  13. What is the most secure seed for random number generation?
  14. Moving old passwords to new hashing algorithm?
  15. Best way for a ‘forgot password’ implementation? [closed]
  16. Should JWT be stored in localStorage or cookie? [duplicate]
  17. Is it worth encrypting email addresses in the database?
  18. Is it possible to reverse a SHA-1 hash?
  19. Secure Google Cloud Functions http trigger with auth
  20. RSA signature size?
  21. What is the appropriate way to manage API secrets within a Google Apps script?
  22. SSO with CAS or OAuth?
  23. Best practices for server-side handling of JWT tokens [closed]
  24. How do I secure REST API calls?
  25. What are best practices for securing the admin section of a website? [closed]
  26. How can I hash passwords in postgresql?
  27. What is the best “forgot my password” method? [duplicate]
  28. Do I need a “random salt” once per password or only once per database?
  29. How easily can you guess a GUID that might be generated?
  30. Has Hardware Lock Elision gone forever due to Spectre Mitigation?

Leave a Comment