Encrypt PDFs directly in Evernote with Automator REDUX

[Jamesgstewart 0]

Greetings,

I've been trying to recreate andy_dg's excellent app for encrypting pdfs directly within Evernote in this slightly older post, but haven't had much luck, in part because links to the screenshots he posted as guides are now stale in that post. Can anyone recommend how to do this? Seems like a really powerful addition to Evernote that a lot of people would benefit from. Big thanks,

James

[DTLow 5,736]

2 minutes ago, Jamesgstewart said:

Encrypt PDFs directly in Evernote with Automator REDUX

I'll follow up with a post filling in the missing information   
I implemented this process and it works well   
   
In the meantime, feel free to post any specific questions 

[JMichaelTX 4,117]

2 hours ago, Jamesgstewart said:

I've been trying to recreate andy_dg's excellent app for encrypting pdfs directly within Evernote

IMO, it is best to encrypt PDFs (and any other files) BEFORE you put them into Evernote.  IAC his process basically encrypts the PDF that is stored outside of Evernote, and then triggers an update/sync.

I have switched to GPG for encrypting all my files.  I'm not sure what level of encryption Andy uses AES-128 or AES256), but I highly recommend AES-256 only.  For more info see:

 

 

 

[DTLow 5,736]

Here are details for the automator script

First, an issue explained
The pdf is embedded in the Evernote database and has to be exported to be encrypted
Evernote takes care of this, and stores the pdf in a temporary folder; captured as {Parent Folder}
Automator encrypts the pdf and moves it to a different folder, with " Encrypted" added to the title
The script has to remove " Encrypted", and move the PDF back to Evernote's temporary folder

Save the script as an application - I used the Applications folder

Automator Steps

1. 
2. 

3. Get file path      

4. 

5. Back to the PDF  

6. 

7. Ensure you include the space before (Encrypted) in rename finder items

8. 

Now right click a PDF in Evernote and Open with... other. 
Browse to the Encrypt PDF app and open it. It should encrypt it and automatically update it in Evernote. 

[DTLow 5,736]

Here are the details for converting the new app to PDF Recommended (copied from @andy_dg)

 

Right click the .app file and select Show Package Contents

We're editing the info.plist file; I use the Textedit app  

Find the section that says      <key>CFBundleTypeExtensions</key> <array> <string>*</string> </array>
Replace with                             <key>CFBundleTypeExtensions</key> <array> <string>pdf</string> </array>

Save Info.plist

[Jamesgstewart 0]

Big thanks DTLow, this is super helpful. I have it up and running. The only problem is that when I try to associate the automator app with pdf files as in your second post, I get this error message, which I've tried for hours to fix based on advice from various other posts. Ultimately, I haven't succeed. Any thoughts?

 

[DTLow 5,736]

14 minutes ago, Jamesgstewart said:

I get this error message

 Try regenerating the app from Automator   
This pdf recommended step is not critical

I so hate the new Apple security/privacy feature

[Jamesgstewart 0]

Thanks. This too was super helpful.

What about decrypting an encrypted pdf within evernote? i.e. the reverse of this encryption process. I know one can manually open the pdf, remove security protections in adobe acrobat, then re-save the document, which does the trick but there has to be a faster way of automating this too I'd think? Is there another app one could trigger by right clicking "open with" again? Can you recommend anything?

Many thanks for all your help. JGS

[Jamesgstewart 0]

Actually, I've purchased a new Fujitsu Scansnap that allows me to encrypt pdfs before they enter into Evernote, so its actually the unencrypting part that's now more important to me. I can do it manually fine, but I'd love to automate it to speed things up. If anyone has suggestions, I'd be forever grateful. Big thanks, JGS

[PinkElephant 8,095]

IMHO it is a contradiction to create encrypted pdfs just to decrypt them automatically. This means using the same password for all files, which is not a real good idea if sensitive data is concerned.

A full decrypt might be possible with the Macs Automator app, but I never tried. And again it means storing the password in the automator script, which is NOT encrypted. This is like the doors key under the mat.

If this does not work, to reduce typing the password over again, it could be stored in a password manager, and copied into the unlock field with a click.

Encrypting means as well loosing the ability to search in these pdfs, etc. So I ask why use EN at all in the first place ?

If I needed a super safe, encrypted storage, I would probably create a container file on my disk using a tool like VeraCrypt. Before I scan, I open the vault and send my scans there. After using it, I close it, locking all information up. For a backup I sync the whole container (encrypted) with a cloud service.

[andy_vdg 12]

This is AWESOME! I just switched back to using a Mac and had scanned a ton of PDF's with my Scansnap. Unfortunately Fujitsu seems to have removed the possibility to encrypt at scan time in their latest Mac version. It still works fine on my PC which is what I've been using since my original post. So I was trying to figure out how I encrypted after the fact in the past. I also found my old post but without the screenshots it's pretty useless and I can't remember that far back. So thanks @DTLow for reminding me how I did it 😄

@JMichaelTX I completely agree and that's what I've been doing for years. My workaround was more for the case where I had bulk scanned pretty much my entire life into Evernote and then afterwards went: "I do kind of trust Evernote but that PDF probably should be encrypted with a password only I know". 
The step in Automator uses AES128 encryption. If you wanted AES256 here are a few options that actually make this whole thing much easier: 

Use QPDF (free)
Install Homebrew and QPDF
Add the Run AppleScript step (This is all that is required)

on run {input, parameters}
	
	set pw to "some super secure password"
	repeat with this_file in input
		do shell script "/opt/homebrew/opt/qpdf/bin/qpdf --encrypt '" & pw & "' '" & pw & "' 256 -- --replace-input " & quoted form of POSIX path of this_file
	end repeat
	
	return input
end run

or if you want it to prompt you each time you could do:

on run {input, parameters}
	
	set mypassword to display dialog "Please enter password for encryption." default answer "" with icon stop buttons {"Cancel", "Continue"} default button "Continue" with hidden answer
	--> {button returned:"Continue", text returned:"mypassword"}
	set pw to text returned of mypassword
	repeat with this_file in input
		do shell script "/opt/homebrew/opt/qpdf/bin/qpdf --encrypt '" & pw & "' '" & pw & "' 256 -- --replace-input " & quoted form of POSIX path of this_file
	end repeat
	return input
end run

Use PDFPenPro ($$) to encrypt (from Redacted and Encrypted PDF's with Hazel and PDFpenPro (macdrifter.com))
Replace the Encrypt PDF Documents step with this AppleScript: 

on run {input, parameters}
	
	set pw to "some super secure password"
	repeat with this_file in input
		tell application "PDFpenPro"
			open this_file
			save document 1 encrypt using AES256 password pw
			quit
		end tell
	end repeat
	return input
end run

You can adapt this as well to prompt for a password like in the QPDF example.

Either example will expect an unencrypted PDF as input. If you try and run this on an already encrypted PDF it will simply fail with an invalid password error (unless the password is the same one you are currently using). 

This post comes with no warranties whatsoever - the usual common sense applies for the use of passwords. If you decide to save your password in an automator action you are accepting that it will not be safe. Follow @PinkElephants advice and use a password manager and just use the prompt version of the above script to stay on the safe side. 

Edited January 30, 2021 by andy_dg
Edited to add processing of multiple input files.

[andy_vdg 12]

@Jamesgstewart I can think of a few use cases where I would want to bulk decrypt files. 

You would use something like this: 

on run {input, parameters}
	
	set mypassword to display dialog "Please enter password for decryption." default answer "" with icon stop buttons {"Cancel", "Continue"} default button "Continue" with hidden answer
	--> {button returned:"Continue", text returned:"mypassword"}
	set pw to text returned of mypassword
	repeat with this_file in input
		do shell script "/opt/homebrew/opt/qpdf/bin/qpdf --decrypt --password='" & pw & "' --replace-input " & quoted form of POSIX path of this_file
	end repeat

	return input
end run

If you don't want to overwrite the encrypted files you can find more options in the QPDF Manual (sourceforge.net)