Office/Word not a good tool for read-only emailed docs?

[tony]

I'm wondering if .pdf would be better. That's what the government
uses mostly it seems. Word docs are too difficult to protect (make
read-only): requires IRM which requires Server 2003 or passport
accounts for recipients and browser client and doubles file size.
Does it really take that much technology to make a doc readonly??!!

Is PDF the simpler solution to sending protected documents
outside of a company (to clients, for example: contracts)?

Tony

 

[Jay Freedman]

Hi Tony

This topic is often discussed in the newsgroups.

You're correct... sort of. Word was always designed to be an *editor*
-- a program for creating and modifying documents. Any efforts to make
Word documents uneditable are really fighting the nature if the thing.

PDF was designed as a display/print format. Unless you have the full
Acrobat authoring program, it is (or was, until recently) fairly hard
to modify an existing PDF file. There are now a number of programs,
mostly optical character recognition (OCR), that can easily turn a PDF
file into a Word file, making PDF considerably less secure than you
think. And it was always possibly to print the PDF and then scan/OCR
the paper copy.

The rule to remember is "if I can read your document, I can alter it."
The only electronic document that's really safe from tampering is the
one you never send to anyone. If it's a matter of legal proof, use
paper or escrow the documents with a third party.

 

[tony]

Hi Tony

This topic is often discussed in the newsgroups.

You're correct... sort of. Word was always designed to be an *editor*
-- a program for creating and modifying documents. Any efforts to make
Word documents uneditable are really fighting the nature if the thing.

PDF was designed as a display/print format. Unless you have the full
Acrobat authoring program, it is (or was, until recently) fairly hard
to modify an existing PDF file. There are now a number of programs,
mostly optical character recognition (OCR), that can easily turn a PDF
file into a Word file, making PDF considerably less secure than you
think. And it was always possibly to print the PDF and then scan/OCR
the paper copy.

The rule to remember is "if I can read your document, I can alter it."
The only electronic document that's really safe from tampering is the
one you never send to anyone. If it's a matter of legal proof, use
paper or escrow the documents with a third party.

So you're saying that the following scenario cannot be had:

I create a contract of some sort, protect it, email it to a client, have them
print it out, sign it and send it back to me via snail mail. I have no way of
knowing if an "or" was changed to "and" somewhere in the document by
any means available. OK, understood.

But what if I just wanted it to be NOT SO EASY to exploit? Couldn't it
be made much more simpler than IRM? What does IRM get me that
some kind of password read-only protection couldn't get me? The problem
with "read-only" in Word is that it's still copyable and saveable, especially
form fields are hard to protect. Why can't MS implement real read-only
where no caret would even show up in the doc and no cut-n-paste or save
as another file would be allowed without the password? Isn't this very
fundamental (sending a contract or other document to someone outside
of the company!)? I just don't understand why it has to be so difficult and
so imposing on authors and recipients (I need a service to send a read-only
doc or receive one? Ouch!).

I'm trying to give a client of mine this functionality and am now looking at
conversion to PDF via a print driver as a simpler solution than IRM to
get read-only functionality. If I would have known this would become an
issue, I may have chosen Acrobat to begin with rather than Word.
Certainly I'm going to be asked by the client why I selected Word in the
first place if we end up converting to PDF in then end.

Tony

 

[tony]

So you're saying that the following scenario cannot be had:

I create a contract of some sort, protect it, email it to a client, have them
print it out, sign it and send it back to me via snail mail. I have no way of
knowing if an "or" was changed to "and" somewhere in the document by
any means available. OK, understood.

But what if I just wanted it to be NOT SO EASY to exploit? Couldn't it
be made much more simpler than IRM? What does IRM get me that
some kind of password read-only protection couldn't get me? The problem
with "read-only" in Word is that it's still copyable and saveable, especially
form fields are hard to protect. Why can't MS implement real read-only
where no caret would even show up in the doc and no cut-n-paste or save
as another file would be allowed without the password? Isn't this very
fundamental (sending a contract or other document to someone outside
of the company!)? I just don't understand why it has to be so difficult and
so imposing on authors and recipients (I need a service to send a read-only
doc or receive one? Ouch!).

I'm trying to give a client of mine this functionality and am now looking at
conversion to PDF via a print driver as a simpler solution than IRM to
get read-only functionality. If I would have known this would become an
issue, I may have chosen Acrobat to begin with rather than Word.
Certainly I'm going to be asked by the client why I selected Word in the
first place if we end up converting to PDF in then end.

Tony

Actually, the functionality I want is available for NON-FORM documents
by including a non-editable form field and then protecting the form. The
problem is that I want that kind of protection for FORMS. What good
would sending a "protected" invoice doc with editable form fields be?!
Is there a way to get the functionality? Is this a bug/oversight in Word?

Tony

 

[Suzanne S. Barnhill]

Well, you choose Word because you can't (practically) *create* documents in
Acrobat.

--
Suzanne S. Barnhill
Microsoft MVP (Word)
Words into Type
Fairhope, Alabama USA

Email cannot be acknowledged; please post all follow-ups to the newsgroup so
all may benefit.

Hi Tony

This topic is often discussed in the newsgroups.

You're correct... sort of. Word was always designed to be an *editor*
-- a program for creating and modifying documents. Any efforts to make
Word documents uneditable are really fighting the nature if the thing.

PDF was designed as a display/print format. Unless you have the full
Acrobat authoring program, it is (or was, until recently) fairly hard
to modify an existing PDF file. There are now a number of programs,
mostly optical character recognition (OCR), that can easily turn a PDF
file into a Word file, making PDF considerably less secure than you
think. And it was always possibly to print the PDF and then scan/OCR
the paper copy.

The rule to remember is "if I can read your document, I can alter it."
The only electronic document that's really safe from tampering is the
one you never send to anyone. If it's a matter of legal proof, use
paper or escrow the documents with a third party.

So you're saying that the following scenario cannot be had:

I create a contract of some sort, protect it, email it to a client, have them
print it out, sign it and send it back to me via snail mail. I have no way of
knowing if an "or" was changed to "and" somewhere in the document by
any means available. OK, understood.

But what if I just wanted it to be NOT SO EASY to exploit? Couldn't it
be made much more simpler than IRM? What does IRM get me that
some kind of password read-only protection couldn't get me? The problem
with "read-only" in Word is that it's still copyable and saveable, especially
form fields are hard to protect. Why can't MS implement real read-only
where no caret would even show up in the doc and no cut-n-paste or save
as another file would be allowed without the password? Isn't this very
fundamental (sending a contract or other document to someone outside
of the company!)? I just don't understand why it has to be so difficult and
so imposing on authors and recipients (I need a service to send a read-only
doc or receive one? Ouch!).

I'm trying to give a client of mine this functionality and am now looking at
conversion to PDF via a print driver as a simpler solution than IRM to
get read-only functionality. If I would have known this would become an
issue, I may have chosen Acrobat to begin with rather than Word.
Certainly I'm going to be asked by the client why I selected Word in the
first place if we end up converting to PDF in then end.

Tony

 

[Suzanne S. Barnhill]

A document doesn't have to have form fields to be protected as a form, but
this type of protection is easily defeated merely by using Insert | File to
insert it into a new blank document.

--
Suzanne S. Barnhill
Microsoft MVP (Word)
Words into Type
Fairhope, Alabama USA

Email cannot be acknowledged; please post all follow-ups to the newsgroup so
all may benefit.

 

[Jezebel]

But what if I just wanted it to be NOT SO EASY to exploit? Couldn't it
be made much more simpler than IRM? What does IRM get me that
some kind of password read-only protection couldn't get me? The problem
with "read-only" in Word is that it's still copyable and saveable, especially
form fields are hard to protect. Why can't MS implement real read-only
where no caret would even show up in the doc and no cut-n-paste or save
as another file would be allowed without the password? Isn't this very
fundamental (sending a contract or other document to someone outside
of the company!)? I just don't understand why it has to be so difficult and
so imposing on authors and recipients (I need a service to send a read-only
doc or receive one? Ouch!).

I can't speak for MS, but the fundamental issue is that there's no point
trying to create a truly read-only document. For most purposes, 'sort-of'
security is worse than none at all. As MS have learnt to their cost, giving
users a false sense of security is unwise. In any case, no matter what you
do, if someone wants to create a changed version of your document they can
always retype the damned thing and make any changes they like. Or OCR it, or
print it to a file, or make it a point of pride to defeat your security. If
you need to check if a document was changed by the reader, you need to
compare versions with your original.

 

[tony]

A document doesn't have to have form fields to be protected as a form, but
this type of protection is easily defeated merely by using Insert | File to
insert it into a new blank document.

Even that is better than having the document directly editable though.
Anyone changing a doc with the insert trick would have a tough time
saying it was an accident. The question becomes though why this
loophole is in Word to begin with.

Tony

 

[tony]

Well, you choose Word because you can't (practically) *create* documents in
Acrobat.

I thought it was just another word processor (?).

Tony

 

[tony]

I can't speak for MS, but the fundamental issue is that there's no point
trying to create a truly read-only document. For most purposes, 'sort-of'
security is worse than none at all.

That's what is there though.

As MS have learnt to their cost, giving
users a false sense of security is unwise.

I don't see anything wrong with providing read-only as long as the level of
security is documented (it could even be build into a wizard or something
so there would be no chance of anyone misapplying it). Certainly there's
a whole bunch of people doing the convert-to-pdf thing and that doesn't
reflect well on Word since it appears incomplete.

In any case, no matter what you
do, if someone wants to create a changed version of your document they can
always retype the damned thing and make any changes they like. Or OCR it, or
print it to a file, or make it a point of pride to defeat your security.

Yeah, but that would be extreme and take time and would probably be
prosecutable.
What recourse does a creator have if he sends an editable document: none! It's
easily editable, the recipient could say, so you must have INTENDED for me to
make
modifications as I see fit! See, there is a place for read-only.

you need to check if a document was changed by the reader, you need to
compare versions with your original.

Yep. And that may be a missing link in Word too: OCR and then verification
of the result or something like that. People now DO the "send it away and
get it back in the mail and then hold it up to the light against the original"
thing
so why not get that process under control?

The whole discussion may be moot anyway though because Word file sizes
are so large. Even if MS "fixed" the read-only problems, conversion to PDF
would probably still be a better solution. I'm investigating that alternative
now.
I may have to look at digital signature technology and stuff before this is all
over, but I think that would again impose too much upon the creator and
recipient for the level of "security" required here.

Tony

 

[Suzanne S. Barnhill]

Not at all. It is basically a printer driver. According to Ted Padova's
"Adobe Acrobat 6 PDF Bible" (page 4):

Acrobat is an authoring application, but it has one little distinction
compared to almost any other authoring program. Rather than starting from
scratch and creating a new document in Acrobat, your workflow usually
involves converting a document, created in just about any program, to a
Portable Document Format (PDF) file. Once the document is converted to PDF
you use Acrobat to edit and refine the document, add bells and whistles,
interactivity, or prepare it for professional printing.

--
Suzanne S. Barnhill
Microsoft MVP (Word)
Words into Type
Fairhope, Alabama USA

Email cannot be acknowledged; please post all follow-ups to the newsgroup so
all may benefit.

 

[tony]

I can't speak for MS, but the fundamental issue is that there's no point
trying to create a truly read-only document. For most purposes, 'sort-of'
security is worse than none at all. As MS have learnt to their cost, giving
users a false sense of security is unwise. In any case, no matter what you
do, if someone wants to create a changed version of your document they can
always retype the damned thing and make any changes they like. Or OCR it, or
print it to a file, or make it a point of pride to defeat your security. If
you need to check if a document was changed by the reader, you need to
compare versions with your original.

Well how is IRM-based read-only better than self-contained read-only then?
Obviously MS DOES think read-only is valuable since the control of who
can edit, copy or print etc is implemented as IRM, so your response above
seems wrong.

Tony

 

[tony]

Not at all. It is basically a printer driver. According to Ted Padova's
"Adobe Acrobat 6 PDF Bible" (page 4):

Acrobat is an authoring application, but it has one little distinction
compared to almost any other authoring program. Rather than starting from
scratch and creating a new document in Acrobat, your workflow usually
involves converting a document, created in just about any program, to a
Portable Document Format (PDF) file. Once the document is converted to PDF
you use Acrobat to edit and refine the document, add bells and whistles,
interactivity, or prepare it for professional printing.

I had no idea! I went to the Adobe site and watched the flash presentation on
Acrobat.
Apparently a class of application program has been developed to overcome the
lack of what I'd consider basic functionality in word processing (and other)
programs.
This story becomes more bizarre as I learn more about the products. Who would
think that a program to create "electronic documents" really only shines in
producing
paper ones and that another program costing hundreds of dollars is required to
actually use a document effectively. Ah.. that's it (!): Word is a
paper-document-centric
program and Acrobat is electronic-document-centric. I get it now. Still seems
bizarre
though. Is it really 2004 already? You'd never know it looking at the state of
some of
this kind of technology! (What was all the hoopla a decade or more ago about
again?
.... umm.. paperless office! I guess it was just a buzzword (well in MS's case
anyway)!).

Tony

 

[Jezebel]

That's what is there though.


I don't see anything wrong with providing read-only as long as the level of
security is documented (it could even be build into a wizard or something
so there would be no chance of anyone misapplying it). Certainly there's
a whole bunch of people doing the convert-to-pdf thing and that doesn't
reflect well on Word since it appears incomplete.

Word already provides a read-only password protection, it just doesn't
achieve much, for the reasons given.

Yeah, but that would be extreme and take time and would probably be
prosecutable.
What recourse does a creator have if he sends an editable document: none! It's
easily editable, the recipient could say, so you must have INTENDED for me to
make
modifications as I see fit! See, there is a place for read-only.

It's not extreme, it doesn't take long, and it's certainly not an offence.
Of course there's a place for read-only. The point is that in practice,
putting a note on the document "Please don't edit this document" is just as
good. Or use Word's protected for forms methods -- if you have cooperative
users, that works fine for avoiding inadvertent modifications.

Yep. And that may be a missing link in Word too: OCR and then verification
of the result or something like that. People now DO the "send it away and
get it back in the mail and then hold it up to the light against the original"
thing
so why not get that process under control?

Not entirely obvious what 'under control' would mean here. Word is not a
(primarily) document management system, but in any case the track changes,
compare versions, and revision control options provide quite a lot of
control. Also, to be fair, adding this sort of arcane functionality to Word
would bloat the product quite considerably. Currently Word has something
over 1000 separate function, of which most people use fewer than 30. I've
used Word a lot, for quite a long time, and there are many features I'd like
to see added, too. But what you see as the 'read-only problem' is not
amongst them. It's never been an issue for what I do, nor for anyone I work
with.

 

[tony]

[Acrobat is] Not at all [a word processor]. It is basically a printer driver.
According to Ted Padova's "Adobe Acrobat 6 PDF Bible" [...]

A $299 print driver! One that takes a paper-centric document and creates an
"electronic document" fits the title much better than Word document
apparently ever will.

Apparently the product most people probably need is Acrobat Elements to
convert Word docs to pdf from within Word with one click without all the
bells and whistles of the full Acrobat product. Unfortunately, Adobe won't
sell Elements to the common man as it's only available in 1000+ seat
licenses to "enterprises". Woe is me and boo on the Adobe capitalist.

Tony

 

[tony]

Word already provides a read-only password protection, it just doesn't
achieve much, for the reasons given.

Or basically, it doesn't work! So why bother putting it in there? Joke's on
the user apparently.

It's not extreme, it doesn't take long, and it's certainly not an offence.

What isn't/doesn't/isn't?

Of course there's a place for read-only. The point is that in practice,
putting a note on the document "Please don't edit this document" is just as
good.

With a post-it note after it's been printed out you mean no doubt!

Or use Word's protected for forms methods -- if you have cooperative
users, that works fine for avoiding inadvertent modifications.

No it doesn't work for forms, that's the problem: you can't protect the form
after it's filled in with data in the fields. The lifecycle scenario of the
form
wasn't thought out far enough: it stops when the user fills in the data and
doesn't consider where that form will go beyond that point. Could one draw
any other conclusion from the implementation? Someone forgot a few boxes
in the flow chart somewhere.

Not entirely obvious what 'under control' would mean here.

See above where I said it looks like someone analyzed the process of form usage
inadequately.

Word is not a
(primarily) document management system,

Or even non-primarily. But the point is not really management, but rather
creation.
And it's supposed to be able to do that. To this point I had trusted that surely
it must be doing that. But now that I know where Acrobat technology fits, Word
seems flawed or truncated or something.

but in any case the track changes,
compare versions, and revision control options provide quite a lot of
control. Also, to be fair, adding this sort of arcane functionality to Word
would bloat the product quite considerably.

It already does OCR I believe. Surely some kind of comparing scheme wouldn't
be so difficult to code up (but I'm not asking for that anyway. I just would
like a
good read-only implementation). Perhaps I'm (once again) asking for a simple
and elegant solution that is adequate for a class of users rather than going to
some kind of full digital processing scenario (surely some businesses contract
digitally, yes?). Remember too that IRM does the read-only thing so MS
recognizes
the functionality as important.

Currently Word has something
over 1000 separate function, of which most people use fewer than 30. I've
used Word a lot, for quite a long time, and there are many features I'd like
to see added, too. But what you see as the 'read-only problem' is not
amongst them. It's never been an issue for what I do, nor for anyone I work
with.

Apparently the void has been filled by Acrobat. So don't try to say that few
require the functionality (if that's what you were trying to persuade). It looks
like MS completely missed the boat on this one.

Tony

 

[Jezebel]

God forbid that the evidence should get in the way of your prejudices!

Word is very far from perfect. There are many parts of it that are really
god-awful. But you're complaining that it fails to do things that can't be
done by any program. 'Acrobat fills the void' is just a silly assertion.
There are any number of things that Word doesn't do, but in principle could:
edit music for example. Does Sibelius fill the void?

Your argument would also be a little more cogent if you'd actually read the
Help files on how form routing works. Like most things, very far from
perfect, but it's kind of childish to complain that the program won't do
things, just because you haven't taken the time to learn how to do it.

 

[Jezebel]

The ordinary Acrobat writer provides a toolbar button in Word, so the PDF is
close to single click from within Word (you still have the dialog to deal
with, not surprisingly). Is this what you had in mind? Single-seat licence
is just fine.

Again, your criticism says more about your ignorance of the product and its
uses than anything else. Why not try it, before being launching forth with
your peurile invective?

[Acrobat is] Not at all [a word processor]. It is basically a printer driver.
According to Ted Padova's "Adobe Acrobat 6 PDF Bible" [...]

A $299 print driver! One that takes a paper-centric document and creates an
"electronic document" fits the title much better than Word document
apparently ever will.

Apparently the product most people probably need is Acrobat Elements to
convert Word docs to pdf from within Word with one click without all the
bells and whistles of the full Acrobat product. Unfortunately, Adobe won't
sell Elements to the common man as it's only available in 1000+ seat
licenses to "enterprises". Woe is me and boo on the Adobe capitalist.

Tony

 

[tony]

The ordinary Acrobat writer provides a toolbar button in Word, so the PDF is
close to single click from within Word (you still have the dialog to deal
with, not surprisingly). Is this what you had in mind? Single-seat licence
is just fine.

Operationally yes. But Adobe's Elements product does that too I believe and
is bare bones functionality whereas the Acrobat product does a bunch of other
stuff and costs $299 (too expensive for a document converter).

Again, your criticism says more about your ignorance of the product and its
uses than anything else. Why not try it, before being launching forth with
your peurile invective?

I think the opinion it's right on track! What part do you have a problem with?
I've been to the Adobe site and read the descriptions. Apparently only large
companies get the simple solution Elements (which could probably be sold
to small installations for much less than the Acrobat product, much of which
functionality is not needed). Perhaps _you're_ the one ignorant of Adobe's
product offerings?

Tony

[Acrobat is] Not at all [a word processor]. It is basically a printer driver.
According to Ted Padova's "Adobe Acrobat 6 PDF Bible" [...]

A $299 print driver! One that takes a paper-centric document and creates an
"electronic document" fits the title much better than Word document
apparently ever will.

Apparently the product most people probably need is Acrobat Elements to
convert Word docs to pdf from within Word with one click without all the
bells and whistles of the full Acrobat product. Unfortunately, Adobe won't
sell Elements to the common man as it's only available in 1000+ seat
licenses to "enterprises". Woe is me and boo on the Adobe capitalist.

Tony

 

[tony]

God forbid that the evidence should get in the way of your prejudices!

Or yours!

Word is very far from perfect. There are many parts of it that are really
god-awful. But you're complaining that it fails to do things that can't be
done by any program.

Wrong. I spelled out the functionality I would like. Apparently IRM can do it
but Word alone can't? I'm not buying that line.

'Acrobat fills the void' is just a silly assertion.

It's fact. How else can it be construed?

Word: file sizes too large for email transmission.
Word: Form processing and protection weak.
Acrobat: file sizes nice for email transmission.
Acrobat: Form processing and protection good.

There are any number of things that Word doesn't do, but in principle could:
edit music for example. Does Sibelius fill the void?

Why use an inappropriate analogy? It's not a stretch of anyone's
imagination that once a document is created it would actually be USED!
(sent via email, sent to someone other than one's mom). Face up to it,
the basic need has been overlooked in Word and is just now being
developed (aka, IRM).

Your argument would also be a little more cogent if you'd actually read the
Help files on how form routing works.

I don't want to route a form though. I want to send a document that
started life as a form. Get it now?

Like most things, very far from
perfect, but it's kind of childish to complain that the program won't do
things, just because you haven't taken the time to learn how to do it.

Your defensive stance has caused you to miss the points entirely! All
your statements direct ad hominem to me, actually pertain to you. I
was being entirely objective from a technical merit standpoint, whereas
you had nothing to add in support of the product you defend except
personal attack. Grow up.

Tony