4 ms·

This is sort of an aside to the article; but it boggles my mind how many people in the business world view PDF's as secure, unalterable documents.

ajross 9y ago
No, Manafort knew what he was doing here, and was doing it for technically sound (albeit legally fraudulent) reasons: Word documents, unlike PDFs[1], store editting history. Manafort knew this, and wanted to evade that tracking. Where he fell down was in the actual conversion step, and in failing to realize that his email to Gates about the conversion were themselves a history of the edit. But his technical instincts were sound. If all Mueller had was that final PDF, he wouldn't have been able to detect the fraud (absent some other info, that is). [1] Obviously "PDF" is a histoically complicated format and some versions have features that might allow tracking. But the PDF/A documents emitted by typical "export" tools are stateless representations of printed documents, AFAIK.
- jacquesm 9y ago
  Exactly. Conversion to PDF 'flattens' the document.
  - scblock 9y ago
    In what way do you mean flattened? Authorship and metadata? No, that is often still present, and many tools will include author and software data by default. Layers? No, PDFs can have extensive layers.
    - enraged_camel 9y ago
      >>In what way do you mean flattened? The document becomes uneditable by most commonly used PDF readers (Adobe Reader DC, web browsers, etc.). You can still edit it, but changing the actual content becomes substantially more difficult.
      - scblock 9y ago
        Editing a PDF is relatively simple with the appropriate tools, and PDFs are not "flattened" by any of the typical definitions I am familiar with. Numerous PDF editors exist, and the standard is well documented (ISO 32000) and freely published online by Adobe. Signing a PDF is a more effective method to prevent tampering, as compared to relying on people only having PDF readers.
    - ajross 9y ago
      > In what way do you mean flattened? Surely in the context of the episode we're talking about: the discovery of the $4M in fraudulent income claimed in the document. In the Word document, that edit would be discoverable. In PDF it is not. You seem to be making an abstract argument about "PDF security" here. The point of the subthread is a practical point about whether Manafort was correctly generating a fraudulent document or whether he was being a technical rube. He was doing the fraud the right way.
      - scblock 9y ago
        I am trying to clear up what appear to be hugely misleading assumptions about how PDFs work. Edit: and based on the information provided in these news reports, he was being a massive technology rube.
        ajross 9y ago
        > I am trying to clear up what appear to be hugely misleading assumptions about how PDFs work. I'm sure you are. But in the process you are spamming an only tangentially related subthread with the clear implication that PDFs store editting history in the way Word documents do (they don't). This is doing the opposite of what you want. No one here is talking about "editing PDFs" or making PDFs "secure from editting", so your points are only confusing the matter.
- JumpCrisscross 9y ago
  > Manafort knew what he was doing here Word has a Document Inspector [1] that cleans up documents’ histories. He had it converted back to a PDF because that’s the format (a) the original document was in and (b) most bank documents are provided as. [1] https://support.office.com/en-us/article/remove-hidden-data-and-personal-information-by-inspecting-documents-356b7b5d-77af-44fe-a07f-9aa4d085966f https://support.office.com/en-us/article/remove-hidden-data-...
- scblock 9y ago
  PDF/A is not typically the standard choice for exporting tools, and it is certainly not a stateless representation of printed documents. PDFs, including PDF/A documents, can and do store extensive metadata, and can include attached files. PDF/A is intended for long-term archiving, not security. Metadata can be removed, and PDF signing can cryptographically prove a file has not been edited or modified, but it is similarly not typically the standard choice for a conversion tool.
- stordoff 9y ago
  I don't think it's necessary to convert to PDF to remove this history (I believe just copying the content to a new document would be sufficient). However, if the recipient is expecting a PDF and gets a Word file, that's going to raise a red flag. The better (technically, not legally) approach might be to directly edit the PDF, though I'm not sure what the tooling is like there.
bluetwo 9y ago
Could have saved a lot of trouble by buying Acrobat Pro.

ajross 9y ago

No, Manafort knew what he was doing here, and was doing it for technically sound (albeit legally fraudulent) reasons: Word documents, unlike PDFs[1], store editting history. Manafort knew this, and wanted to evade that tracking. Where he fell down was in the actual conversion step, and in failing to realize that his email to Gates about the conversion were themselves a history of the edit. But his technical instincts were sound. If all Mueller had was that final PDF, he wouldn't have been able to detect the fraud (absent some other info, that is). [1] Obviously "PDF" is a histoically complicated format and some versions have features that might allow tracking. But the PDF/A documents emitted by typical "export" tools are stateless representations of printed documents, AFAIK.

jacquesm 9y ago
Exactly. Conversion to PDF 'flattens' the document.
- scblock 9y ago
  In what way do you mean flattened? Authorship and metadata? No, that is often still present, and many tools will include author and software data by default. Layers? No, PDFs can have extensive layers.
  - enraged_camel 9y ago
    >>In what way do you mean flattened? The document becomes uneditable by most commonly used PDF readers (Adobe Reader DC, web browsers, etc.). You can still edit it, but changing the actual content becomes substantially more difficult.
    - scblock 9y ago
      Editing a PDF is relatively simple with the appropriate tools, and PDFs are not "flattened" by any of the typical definitions I am familiar with. Numerous PDF editors exist, and the standard is well documented (ISO 32000) and freely published online by Adobe. Signing a PDF is a more effective method to prevent tampering, as compared to relying on people only having PDF readers.
  - ajross 9y ago
    > In what way do you mean flattened? Surely in the context of the episode we're talking about: the discovery of the $4M in fraudulent income claimed in the document. In the Word document, that edit would be discoverable. In PDF it is not. You seem to be making an abstract argument about "PDF security" here. The point of the subthread is a practical point about whether Manafort was correctly generating a fraudulent document or whether he was being a technical rube. He was doing the fraud the right way.
    - scblock 9y ago
      I am trying to clear up what appear to be hugely misleading assumptions about how PDFs work. Edit: and based on the information provided in these news reports, he was being a massive technology rube.
      - ajross 9y ago
        > I am trying to clear up what appear to be hugely misleading assumptions about how PDFs work. I'm sure you are. But in the process you are spamming an only tangentially related subthread with the clear implication that PDFs store editting history in the way Word documents do (they don't). This is doing the opposite of what you want. No one here is talking about "editing PDFs" or making PDFs "secure from editting", so your points are only confusing the matter.
JumpCrisscross 9y ago
> Manafort knew what he was doing here Word has a Document Inspector [1] that cleans up documents’ histories. He had it converted back to a PDF because that’s the format (a) the original document was in and (b) most bank documents are provided as. [1] https://support.office.com/en-us/article/remove-hidden-data-and-personal-information-by-inspecting-documents-356b7b5d-77af-44fe-a07f-9aa4d085966f https://support.office.com/en-us/article/remove-hidden-data-...
scblock 9y ago
PDF/A is not typically the standard choice for exporting tools, and it is certainly not a stateless representation of printed documents. PDFs, including PDF/A documents, can and do store extensive metadata, and can include attached files. PDF/A is intended for long-term archiving, not security. Metadata can be removed, and PDF signing can cryptographically prove a file has not been edited or modified, but it is similarly not typically the standard choice for a conversion tool.
stordoff 9y ago
I don't think it's necessary to convert to PDF to remove this history (I believe just copying the content to a new document would be sufficient). However, if the recipient is expecting a PDF and gets a Word file, that's going to raise a red flag. The better (technically, not legally) approach might be to directly edit the PDF, though I'm not sure what the tooling is like there.

bluetwo 9y ago

Could have saved a lot of trouble by buying Acrobat Pro.