3

Question

Is it correct that saving a PDF to the hard disk first, and then opening it from there with some PDF reader (not the browser) is safer than opening it directly with the browser plugin?

My current understanding

I know that the PDF browser plugin might have a security leak and a manipulated PDF file might exploit it and get access to the user's computer.

I recently heard that saving the PDF file first and opening it then was safer. I don't understand why that should be safer. Can anyone explain?

My logic would suggest that a manipulated file started from the hard disk can just as well exploit a security leak, say for instance, of Adobe Acrobat Reader.

7 Answers 7

2

No. Most browsers treat downloaded files as unsafe and restrict what they can do, while files on your hard disk are considered safer and may be granted elevated permissions when executing. For the record, I always download PDFs first as a HATE viewing them in a plug-in. But... There's no enhanced (and possible less) security from doing so.

1
  • I still don't know what the "true" answer to my question is, but since this answer gave the most explanation, I'm choosing this one.
    – Lernkurve
    Mar 25, 2010 at 15:19
4

It is safer to save to the harddisk first (most practical if using a PDF reader) if the PDF reader is safer than the browser plugin.

I use Foxit Reader as the PDF reader because of Adobe's "interesting" track record when it comes to security (for instance JavaScript is enabled by default in Acrobat Reader even though most documents do not need JavaScript). Foxit Reader is also much faster in launching and in going from page to page.

3
  • JavaScript is also enabled by default in Foxit reader. The first thing I do after installing it is turn it off. Mar 25, 2010 at 7:21
  • But why is a PDF reader safer than the browser plugin? Isn't the PDF reader running with higher trust settings than the browser plugin, and therefore, an exploit could do just as much or more harm?
    – Lernkurve
    Mar 25, 2010 at 7:46
  • @Lernkurve - He means that if there is an exploit for the browser that doesn't exist in the viewer. Exploits take advantage of vulnerabilities in the application code - bad design, programmer error, etc. So if one program has less (or less severe) vulnerabilities than the next, it is in theory safer. If you want to know more, see this book: nostarch.com/hacking2.htm Mar 25, 2010 at 18:40
2

It doesn't matter if you open it up in a new tab / window or save it and then open it. The browser will cache the PDF where it stores it's temporary files if you choose to open it up directly. Otherwise it will be opened up from where you stored it.

Any exploits that could be executed will still be executed because you are still using the browser to open up the PDF.

My advice, use Acrobat instead.

2
  • Sorry, I wasn't specific enough: I meant saving it to the harddisk and opening it with some PDF reader (Foxit Reader, Sumatra PDF, Acrobat Reader), not the browser or browser plugin, i.e. not from the browser cache.
    – Lernkurve
    Mar 24, 2010 at 23:13
  • In that case yes it would be different. It might not be explicitly more secure, but it could be.
    – Josh K
    Mar 24, 2010 at 23:16
2

My reasons for not opening PDFs in the browser:

  • It's very slow as the plugin loads and downloads the PDF file (although this is not much different if you have the very slow Adobe Reader on the desktop).
  • It can freeze up the browser a lot.
  • Often you want to download the file anyway - there isn't usually a "save as" option once open.
  • Like Flash, it breaks browser conventions (things like selecting text, copy/paste, maybe the back button).
  • I use an open source PDF reader (since it's way faster), which doesn't have a browser plugin.

Honestly, security never factors into it. I doubt the PDF plugin made by Adobe is any less secure than the separate app.

1

Yes, you're correct in saying that a security exploit in any program can be exploited. It's also true that you're antivirus might be out of date, or a new exploit is in a file, etc.

While I do sometime open pdfs in my browser, I usually immediately save it to disk and then open it in Acrobat Reader. Is this safer? I don't know. But it's a whole lot easier to read than in the browser.

My general rule of downloads is that if I'm not certain of a file, I'll download it then run a virus scan on it before opening it. If there is a md5sum/sha1sum/etc. listed on the site that I downloaded from, I'll check that also or instead (ie, I don't scan Linux CDs...).

1

You may have heard that Mac computers are safer than Windows computers, but this is often because malicious people focus on finding security weaknesses in Windows -- the most installed operating system -- because they can affect more victims that way.

In the same way, malicious people focus on finding security weakness in Adobe Reader and its web browser plug-in because they can affect more victims that way. You might be safer downloading a PDF file and viewing it in another less commonly used PDF viewer, but that's only one factor to consider.

Staying safe involves many other factors: Does the source of the PDF file seem trustworthy or shady? Do you keep your PDF viewer and other software updated? Do you scan any files you download for viruses? And so on.

1

I prefer opening PDFs in Google Docs Viewer (and since I'm using Chrome, it can't get any easier with the viewer extension). Where the PDF is protected by a session, thus unaccessible to the viewer, Foxit Reader browser plugin comes in handy.

The reason? Less work, less crap stored - if I manually downloaded the file, I would have to delete it afterwards (that means I'd have to once again dig in that mess of my downloads folder).

Also, the viewer adds some extra sense of security (if you trust Google, that is) - since PDFs are processed on Google's servers and the resulting renderings (just pure PNGs) are sent over a secure connection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .