Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?

share|improve this question
8  
As always, it depends on the threat you are worried about - can you elaborate? Also, more specifically with PDF, it depends on the way they've encrypted it. Over the years, the built-in encryption in Adobe PDF has changed from 40-bit RC4 when it was introduced, to 256-bit AES now. However, many people still use the weaker methods, to ensure that older PDF readers can open them. Do you know what your bank uses? –  Graham Hill Jan 9 '12 at 17:25
1  
It will also be important to note how the bank shares the PDF file's password with you. If it's in the clear, in the same e-mail that has the PDF file (or even through the same e-mail account), then that protection is negligible. –  Iszi Jan 9 '12 at 17:57
1  
What information is stored in these files. If your full account information is stored, then I would get a new bank, and the complain to the FCC. I would have a serious problem with a document with ALL my account information being sent to me in any form honestly( which is the reason I am only sent a link, which requires me to log into the website to view, to my statements ). –  Ramhound Jan 9 '12 at 19:54
    
My concern is that someone else can can read the crack the PDF file and read its contents. The file arrives in predictable fashion between day x and day x+-2 of the month. @Iszi, the bank does not provide the password in the email. However they did provide it to me when I spoke to a teller in person. Ramhound- Statement contains complete account number, and mailing address. –  zundarz Jan 9 '12 at 20:46
1  
@Iszi - I meant the FTC. If the bank is sending this sort of information to your email I would be concerned. While not a trivial task, you can brute force a password on a pdf file. I am going to guess were talking about just a password to access the file, and the contents are not encryped, which is even worst. In other words CHANGE BANKS they may as well be sending all your information in plain text. –  Ramhound Jan 11 '12 at 17:04
show 5 more comments

3 Answers

up vote 7 down vote accepted

No, the use of a password protected PDF file is simply not good enough for sensitive data.

As others have already stated, newer version of the PDF standard use much better encryption methods than they originally did, however, a password on a file (even a strong one) will always be susceptible to brute force attacks. At this point you're just hoping their computer is slow enough that by the time they crack your (hopefully strong) password, the information is irrelevant. That's a lot of 'hopefully-s.' Assuming monthly bank statements, and a password under 50 characters, the security of your documents is starting to sound almost laughably naive.

This could also create a security risk in other ways depending on where the bank gets the password. I know of a bank that does something similar to this and uses your account password to encrypt the document, so that you only have to remember one password. This means they are storing your account password on the server. It may be encrypted, and it may not be, but either way it's probably safe to assume that any attacker that manages to break into your banks server and get a database dump now has your password. There is no excuse for saving passwords as anything but salted hashes (the same bank emails you your password if you forget it... yup, in a plaintext email).

If you can, call your bank and ask them to start sending you your statements encrypted using a public key system. PGP and S/MIME are both great, and will put a bit more security in your hands (it will be your job to protect your private key, not your banks).

Many banks also provide RSA tokens (or equivalent technology) for relatively cheap. Although there have been some (serious) security breaches with RSA in particular lately, this is still a great addition to your account security if your bank offers it.

share|improve this answer
    
50 characters!? As a benchmark, 14 characters ~100 bits maximum entropy, which is more than enough if the PDF encryption is configured correctly. –  lynks Nov 19 '13 at 13:09
add comment

I wouldn't even almost trust the security of it even if it didn't have such valuable personal information in it.

The encryption standard Adobe uses for the newest versions is not bad at all as Graham mentioned, but the bigger issues is the actual implementation of it. (Though the implementation in Adobe 8 was actually a bit better even though it was only 128 bit encryption as Adobe themselves even admitted).

Elcomsoft markets a product specifically for PDF password avoidance (not necessarily retrieval) that works quite well according to tests I've seen by 3rd parties (including CMU).

Combining that fact with the chance that the password itself could be insecure/easily guessable, the fact that it is sent in a predictable fashion to an account that could itself be compromised, and the fact that they store anything about you in it and that's a recipe for disaster/a new bank/a new policy for them at the very least.

share|improve this answer
add comment

I guess many banks don't consider monthly statements to be very "sensitive data", as far as I know lot's of banks have rather low bars when it comes to monthly statements.

As others said, I think PDF encryption is not the best,

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.