That is, can they send any personally identifiable information to an external host (for example, the PDF author's server)? If so, is there a way to disable this in common PDF viewers (Adobe Reader, Mac OS X Preview) without resorting to using a firewall rule?
I haven't tried any recent versions of Reader, but my latest version (Reader 6.0) installed with many many plugins that slowed down the program's startup. Many of these plugins are how forms and scripting functionality are supplied.
You can control which plugins start by moving them out of Reader's plugin directory. For me, that's
C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins
You should make a folder, say, at
C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins_old
and move any unwanted plugins to that directory. I got a nice speedy program start by moving all the plugins into plug_ins_old except for these:
EWH32.api Search.api Search5.api eBook.api printme.api
Most people will be using more recent versions of Reader, so I imagine the process may be a little different, but that may be a good place to start looking. If Reader stops opening after you've moved a plugin, just move it back and re-try.
the documents don't, certain applications to open them (e.g. Adobe Reader) do have the capability to phone home (the software maker, not the author of the document, that is). they can be "silenced" with outbound firewall rules.
Adobe Reader is also plagued by a variety of security vulnerabilities, that can be triggered by documents and should not be taken lightly.
I don't know how it works, but somewhere in 2002 I used Adobe Reader to fill in an offline PDF tax-paper. Upon pressing a button within that PDF form, it prompted for my password, encrypted itself, connected to the internet, and sent itself (or its data) to the tax-collector's office. It then told me the password was actually wrong, and had me repeat the steps.
So, assuming pressing a button is not really required to do this, I guess any PDF document that is actually a form can phone home when opened in a capable reader.
Also, some read-only PDF forms actually always fetch the data they show from the internet. I have had some digital bills sent to me through email, which would open fine when I got them. However, some time later after the web shop had changed their web site, the bills showed up empty when I opened them again.
Depends on your definition of ‘personally identifiable’. Scripts in PDF don't have any particular way to gather information on their own, but they can certainly connect to the network (through SOAP or scripted form submission) and upload any information you put into them (along with your IP address, of course).
If you have a DRM-protected PDF the authorisation process will also necessarily upload a unique ID for your installation and file.