Security of pdf reader

Yes, that's true. Even the other day I had to allow JavaScript for such a PDF.

 

That's assuming that you trust Adobe's security and that you want their reader. I prefer something far less bloated.

It's hard to miss that you almost always recommend the big company's wares.

 

If that were the case I'd recommend IE etc. I typically recommend Adobe because
1) It has the sandbox
2) It's very common and most PDFs work with it (kind of like back when IE was the browser that websites were "made for" or tested against.)

It's not about trusting Adobe's security for the most part. The security is provided in the Windows kernel.

If you want to use Foxit or something else by all means go ahead.

EDIT: Of course my official endorsement is of all MS and Google products. Gotta get that paycheck after all.

 

OK. We're looking at the same thing but with different setups and from different perspectives. I tend to focus more on the interprocess activity and look for the common points that can be used to intercept the process. The i-frame you mention gets used quite a bit. Apps like Proxomitron deal with those very nicely.

Regarding PDF usage in business/office scenarios, IMO, they have a decision to make. They need to weigh the time saved by opening it in the browser against the potential risk and cost of a malicious file.

One factor that needs to be given more weight is the potential of a targeted attack, something that is becoming much more common in the business/industrial environment. It can get very difficult to determine the source, especially if you're not a security researcher. IMO, they'd be farther ahead to switch to a safer format, especially for internal use.

 

I was referring to home users. Yes, businesses cannot be expected to be able to evaluate sources, since unsolicited documents arrive all of the time, which is fertile ground for the targeted attack.

This was discussed at some length in a long thread last year. Many solutions were offered.

For example, Peter2150 has a small office with two Office workers, and his solution is to set up Sandboxie on the office computers to protect against possible intrusion via malicious documents.


----
rich

 

Some might call that being pragmatic --- recommending something because one would benefit by servicing it later when problems arise. We see that a lot, don't we! I'd never recommend Adobe. They've made a mockery of the "p" in pdf.

 

It was a joke >_> but apparently not a very good one!

I recommend Adobe because it uses integrity levels, which are effective. What does any other reader do other than have no market share?

Market share is also important for reliability. So Adobe has a sandbox and market share - why would I recommend anything else?

I don't make recommendations to "help the little guy" pdf readers who need support.

 

The beauty of it, is that, there are many alternatives out there. Let others know about all of them and let them choose.

I'm pretty sure most of those coming at WSF know that if everyone starts using Foxit or some other, this one will be the target. Then, everyone will say Adobe Reader is one of the most secure PDF readers, and that Foxit/other is the least safest.

I think I mentioned this a long time ago, but I think it's never too much to say it... I remember reading an article at F-Secure blog where they were advising a different PDF reader other than Adobe's Reader. But, they alerted they weren't advising a specific one, rather for users to find other alternatives. And, not to do the same mistake of when 40% of IE6 users started using Firefox, which meant 40% of attacks began to focus on Firefox as well.