{"id":12408,"date":"2007-06-27T21:02:23","date_gmt":"2007-06-27T21:02:23","guid":{"rendered":"http:\/\/blogs.adobe.com\/jnackdev\/2007\/06\/why-photoshop-doesnt-provide-secure-metadata.html"},"modified":"2007-06-27T21:02:23","modified_gmt":"2007-06-27T21:02:23","slug":"why_photoshop_doesnt_provide_secure_metada","status":"publish","type":"post","link":"https:\/\/jnack.com\/blog\/2007\/06\/27\/why_photoshop_doesnt_provide_secure_metada\/","title":{"rendered":"Why Photoshop doesn&#039;t provide secure metadata"},"content":{"rendered":"<p>Certain feature requests come up over and over, and customers wonder why Adobe doesn&#8217;t address them.&nbsp; In many cases it&#8217;s a matter of time, resources, and priorities<br \/>\n(i.e. good idea, we just haven&#8217;t gotten there yet).&nbsp; In other cases, however, there are conceptual issues that make addressing the request impractical or impossible.<\/p>\n<p>One of those cases concerns something that seems simple: letting Photoshop users  apply copyright &amp; other info, then lock it so that it can&#8217;t be removed.&nbsp; Photographers in particular request this capability year in and year out.&nbsp; Unfortunately there are good reasons why things don&#8217;t work as desired.&nbsp; If you&#8217;re interested in the details, read on for an explanation from Photoshop architect Russell Williams. <\/p>\n<p><!--more--><\/p>\n<hr \/>\n<p><\/p>\n<p>If I understand what you&#8217;re looking for &#8212; a way to distribute your image so that somebody can&#8217;t strip out the copyright, the only way to come close is to embed the copyright in the image with a watermark, either visible or invisible. Digimarc can do it with a mostly-invisible watermark. The less visible it is, the less robust it is to image manipulation.<\/p>\n<p>It&#8217;s not just that the capability is lacking in Photoshop to attach a non-removable copyright. It is not logically possible to put a copyright notice in metadata (not embedded in the image data) in a way that it can&#8217;t be removed.<\/p>\n<p>If the image data is accessible to someone, there&#8217;s no way to force them to keep the copyright notice with it. There are lots of programs that will open and re-save JPEGs, TIFFs, and even PSDs.&nbsp; It would be trivial to produce a version that doesn&#8217;t save the copyright with it.&nbsp; Not to mention metadata editing programs that can just remove or change arbitrary metadata. There&#8217;s no way to stop somebody from using one of those programs.<\/p>\n<p>Even if they don&#8217;t happen to have a program that will re-save the image without the copyright or edit the metadata, they can always &quot;print to PDF&quot; out of any program that can open the image, or even show the image at 100%, do screenshots while scrolling around the image, and reassemble it. If they can see it, they can remove any attached copyright notice.<\/p>\n<p>Everything else comes down to only sending the full resolution version to people you trust, because anybody who has the full resolution version can strip out any associated metadata.<\/p>\n<p>You can send out two versions together, one encrypted and one not encrypted &#8212; a low resolution unencrypted version and a high resolution encrypted version, or a visibly watermarked unencrypted version and an unwatermarked encrypted one.  Of course anybody who&#8217;s going to legitimately decrypt the encrypted version has to have the matching software to do it.<\/p>\n<p>Acrobat 7 or later will let you attach an arbitrary file to a PDF and encrypt only the attached file. You could send out a low resolution or visibly watermarked PDF and attach the full PSD to it in encrypted form. Anybody with a PDF reader can get the low resolution version, but getting the high resolution version out requires opening it with Acrobat and extracting the attached file with the required password. You can do essentially the same thing with any password utility and WinZip or similar program to package the two files together.<\/p>\n<p>That approach is cryptographically secure &#8212; hackers can&#8217;t work around the password. This is true because it&#8217;s fundamentally different from the &quot;PDF\t permissions&quot; password or the DVD or iTunes protection schemes. In those schemes, the data has to be decrypted in order to be displayed, played or used, and you&#8217;re relying on the software to prevent the user from doing something you don&#8217;t like with the data once it&#8217;s decrypted. But once it&#8217;s been decrypted for any reason, it&#8217;s vulnerable to hacking, screen shots, capturing the audio signal going to the computer&#8217;s speaker, or whatever. In contrast, in the &quot;two file&quot; scheme mentioned above, you&#8217;re never decrypting the protected file on an untrusted person&#8217;s computer.<\/p>\n<p>But even a cryptographically secure password still relies on your trust in the people to whom you give the password.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Certain feature requests come up over and over, and customers wonder why Adobe doesn&#8217;t address them.&nbsp; In many cases it&#8217;s a matter of time, resources, and priorities (i.e. good idea, we just haven&#8217;t gotten there yet).&nbsp; In other cases, however, there are conceptual issues that make addressing the request impractical or impossible. One of those [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/posts\/12408"}],"collection":[{"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/comments?post=12408"}],"version-history":[{"count":0,"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/posts\/12408\/revisions"}],"wp:attachment":[{"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/media?parent=12408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/categories?post=12408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jnack.com\/blog\/wp-json\/wp\/v2\/tags?post=12408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}