My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
10
-
10As always, it depends on the threat you are worried about - can you elaborate? Also, more specifically with PDF, it depends on the way they've encrypted it. Over the years, the built-in encryption in Adobe PDF has changed from 40-bit RC4 when it was introduced, to 256-bit AES now. However, many people still use the weaker methods, to ensure that older PDF readers can open them. Do you know what your bank uses?– Graham HillJan 9, 2012 at 17:25
-
1It will also be important to note how the bank shares the PDF file's password with you. If it's in the clear, in the same e-mail that has the PDF file (or even through the same e-mail account), then that protection is negligible.– IsziJan 9, 2012 at 17:57
-
1What information is stored in these files. If your full account information is stored, then I would get a new bank, and the complain to the FCC. I would have a serious problem with a document with ALL my account information being sent to me in any form honestly( which is the reason I am only sent a link, which requires me to log into the website to view, to my statements ).– RamhoundJan 9, 2012 at 19:54
-
My concern is that someone else can can read the crack the PDF file and read its contents. The file arrives in predictable fashion between day x and day x+-2 of the month. @Iszi, the bank does not provide the password in the email. However they did provide it to me when I spoke to a teller in person. Ramhound- Statement contains complete account number, and mailing address.– zundarzJan 9, 2012 at 20:46
-
1@Iszi - I meant the FTC. If the bank is sending this sort of information to your email I would be concerned. While not a trivial task, you can brute force a password on a pdf file. I am going to guess were talking about just a password to access the file, and the contents are not encryped, which is even worst. In other words CHANGE BANKS they may as well be sending all your information in plain text.– RamhoundJan 11, 2012 at 17:04
|
Show 5 more comments
3 Answers
No, the use of a password protected PDF file is simply not good enough for sensitive data.
As others have already stated, newer version of the PDF standard use much better encryption methods than they originally did, however, a password on a file (even a strong one) will always be susceptible to brute force attacks. At this point you're just hoping their computer is slow enough that by the time they crack your (hopefully strong) password, the information is irrelevant. That's a lot of 'hopefully-s.' Assuming monthly bank statements, and a password under 50 characters, the security of your documents is starting to sound almost laughably naive.
This could also create a security risk in other ways depending on where the bank gets the password. I know of a bank that does something similar to this and uses your account password to encrypt the document, so that you only have to remember one password. This means they are storing your account password on the server. It may be encrypted, and it may not be, but either way it's probably safe to assume that any attacker that manages to break into your banks server and get a database dump now has your password. There is no excuse for saving passwords as anything but salted hashes (the same bank emails you your password if you forget it... yup, in a plaintext email).
If you can, call your bank and ask them to start sending you your statements encrypted using a public key system. PGP and S/MIME are both great, and will put a bit more security in your hands (it will be your job to protect your private key, not your banks).
Many banks also provide RSA tokens (or equivalent technology) for relatively cheap. Although there have been some (serious) security breaches with RSA in particular lately, this is still a great addition to your account security if your bank offers it.
-
950 characters!? As a benchmark, 14 characters ~100 bits maximum entropy, which is more than enough if the PDF encryption is configured correctly.– lynksNov 19, 2013 at 13:09
-
It's not because it can't be salted so if someone can get that email and the PDF it's going to be fairly straightforward to brute force it, despite the length. I just made up 50 though, the bank would likely make it something short that a user can type easily which isn't great. Jan 28, 2021 at 13:09
I wouldn't even almost trust the security of it even if it didn't have such valuable personal information in it.
The encryption standard Adobe uses for the newest versions is not bad at all as Graham mentioned, but the bigger issues is the actual implementation of it. (Though the implementation in Adobe 8 was actually a bit better even though it was only 128 bit encryption as Adobe themselves even admitted).
Elcomsoft markets a product specifically for PDF password avoidance (not necessarily retrieval) that works quite well according to tests I've seen by 3rd parties (including CMU).
Combining that fact with the chance that the password itself could be insecure/easily guessable, the fact that it is sent in a predictable fashion to an account that could itself be compromised, and the fact that they store anything about you in it and that's a recipe for disaster/a new bank/a new policy for them at the very least.
I guess many banks don't consider monthly statements to be very "sensitive data", as far as I know lot's of banks have rather low bars when it comes to monthly statements.
As others said, I think PDF encryption is not the best,
