security issue with protected pdf when using "attach files"

[lisec 283]

I have a password protected pdf in my document (password entered using Acrobat).

I put it in Evernote and all is fine, except that I'd rather just see an attachment than the whole big black box with the "enter password" field. 

 

But once a password protected pdf is in the note, there is there no way to right-click and select "view as attachment".

Ok, so I tried it the other way.

1. I deleted the pdf from my note, right-clicked in the note and selected "Attach Files". 
2. I browsed to my pdf and bingo, it is displayed as an attachment. Great. 

Except that when I double-click on the attachment in Evernote, it opens in Acrobat and I can see the entire note behind a small dialog box asking me for my password!  All the info I wanted to hide is right there to see!  

 

[gazumped 11,652]

You've really not been having a good day have you?  😉

The big black screen thing seems to be the PDF showing as 'inline'.  You can either open the file with the password,  then use 'show as attachment' and close it again,  or drag and drop initially with the shift key to get the 'attached' icon into the note.

I don't get any visible content when opening the note - just the black screen and a password box.  Tried that both times.  Maybe restart your system and see if that happens again?

(It's now silly o'clock at Gaz Towers UK so I'm off to bed.  Good luck with the glitch - I'll look forward to tomorrow's instalment...😊)

[lisec 283]

I'm an idiot is what I am.

I had the document already open in Acrobat, so when I opened it again through Evernote, the password box was displayed over top the existing open note in Acrobat which happened to be the same note, so that made me think it was displaying the note while asking for the password.  Yup. 4 espresso is obviously not enough for this gal.

.

[PinkElephant 8,077]

By the way: The password protection of pdf can be circumvented with not much trickery needed. So do not rely on it for really juicy stuff ...

[lisec 283]

Shoot. Here I was thinking I was doing a good thing.

Do you use something to protect pictures of receipts, taxes, that sort of thing?

 

[PinkElephant 8,077]

No - who cares ? The data is protected by Transport layer encryption when syncing, and it is encrypted on the server. Sure, EN holds a key to that to work some wonders on it, like OCRing and AI functions. But they say (and I believe them, because it would be strongly discussed if not) that humans will not access the users data. They do not even data mine Basic accounts, which practically everybody else is doing on freemium stuff. Have a gmail free account ? G will read the Mails (automatically), and see that you get your share of interesting ads to make up for not paying. EN does not ...

And what would they find out ?

That I don’t earn what I deserve ? Well, nobody does. That I cheat on my taxes ? Well, nobody does (keep 🤞). That I missed Black Friday and paid too much on that Gadget I bought last week ... Not everything in there is really that important. And PW encryption of individual files is a pain in the A.

Sensitive information I keep in my password manager, or in encrypted vaults where the vault itself is encrypted, military strength. The content is open, as soon as the vault is decrypted.

[DTLow 5,736]

50 minutes ago, lisec said:

Do you use something to protect pictures of receipts, taxes, that sort of thing?

For sensitive data, I use the native encryption of PDFs and Office/iWork documents

The PDF encryption level is 128-bit AES (strong)

[gazumped 11,652]

Woo. That's a good question with a pretty long answer. The short(ish) version,  like a certain pink pachyderm around here, is that I use passworded PDFs just like you. My casual security is down to the fact that of 48,000 and some notes in my database only a relative few(hundred) are in need of protection, and my library is part of the billion or so notes in various languages on Evernote's proverbial books.  Even an AI process is going to take a while to work out where my stuff is,  and which notes hold the plans for World Domination.

Plus anything I hold really dear (like The Plans) is on paper and in a drawer near my desk.  Anything with bank details is in an unsynced local notebook regularly backed up to a local hard drive,  and my passwords to everything are with Bitwarden - which puts out some useful random sequences for passwords,  like @Dq3J&N@&R (not otherwise in use!).

[lisec 283]

PinkElephant & gazumped - I always had that same 'who cares' type of attitude. I mean, like gazumped says, there's so much stuff out there that if they really want to find that picture of my driver's license that I keep for when I travel, well, they deserve to get it for all the work they did to find it. Also, we use google home devices, alexa, we store stuff in this cloud and that cloud, and it was all so overwhelming that at one point we gave up. "It's the new way" we said. "There isn't much The Cloud does not already have" we said. "Lets just flood it with so much stuff that it will bury the important stuff".

All true in a sense. All quite logical if a bit defeatist. And yet there's something that doesn't sit well with me... So 3 days ago I took it upon myself to search and encrypt every instance of my full address and phone number in all my Evernote notes. Then I had the pictures of receipts to deal with as well.  SO much work and no where near done (Evernote does not make it easy).

But then I remembered something Warren Buffett said: make a list of your top 25 priorities in life. Circle the 5 most important. Delete all the other ones - they just interfere with the important ones.  So, yeah, excuse the language but ***** that. For every receipt i don't encrypt I can write 3-5 lines of a screenplay.

 DTLow - I read that you encrypt or password protect your pdfs. Like everything else, it must be simpler to do on a MAC 😉

[gazumped 11,652]

...Possibly weirdly,  in the real world I do shred a lot of what I scan - after a decent wait so I'm sure it doesn't need re-scanning - especially the bits with my address and most of the receipts with obfuscated account and card numbers.  My theory is that anyone with a grudge against me personally is going to start as close to my base as possible:  but any stalker dumpster diving is only going to turn up hamster bedding,  not evidence of anything... and anyway those floor plans of the Bank of England could belong to anyone...

[lisec 283]

1 minute ago, gazumped said:

...Possibly weirdly,  in the real world I do shred a lot of what I scan - after a decent wait so I'm sure it doesn't need re-scanning - especially the bits with my address and most of the receipts with obfuscated account and card numbers.  My theory is that anyone with a grudge against me personally is going to start as close to my base as possible:  but any stalker dumpster diving is only going to turn up hamster bedding,  not evidence of anything... and anyway those floor plans of the Bank of England could belong to anyone...

Ha!  I shred stuff too, and for the same reason - so that I don't stick it in evernote again!I And before I throw junk mail in the recycling bin I tear off the name and address part and stick in the wood burner.  I might not care if the entire world has my info, but I won't let the guy at the dump get my address 😉

Now about those floor plans...

[DTLow 5,736]

43 minutes ago, lisec said:

I took it upon myself to search and encrypt every instance of my full address and phone number in all my Evernote notes.

Not quite my definition of "sensitive information"
I have faith in Evernote's security and my personal data security, but I have a small list of encrypted items
examples: Scan of my passport, password list (backup)

>>Like everything else, it must be simpler to do on a MAC 😉

It just works (Apple slogan) 

[PinkElephant 8,077]

The sequence was this:

Get an EN account, start to fill it => Oooops, that is tedious work on a slow scanner

Get a better Scanner => Damn, that ix500 is fast / in creating a heap of paper

Get a solid shredder (the one before self-destructed under ix-pressure)

So I got myself a shredcat, that holds up to 150 pages in a tray and munches them one by one. I collect scanned stuff until I have appr. 100 pages (just in case a sync goes bad, which up to now never has happened). Then I drop them in, close the lid, press the green button and can take the result of total informational destruction out 10min later. Very satisfying.