We have a very specific use case for an application we're developing, where a user will be presented with a PDF document, which they can print off. However, we need to be able to restrict the PDF so it can only be printed off once. Does anyone know if there's a way to restrict the number of times a PDF can be printed.
I'm aware the PDF spec has lots of security features, but I've not found reference to anything like this before.
Adobe use their Adobe Content Server to protect eBooks and PDFs along with Adobe Digital Editions (their free eBook and PDF reader) on the client side. This allows the distribution of PDFs with more flexible security options than the usual standalone PDF will allow. For example, documents can be time limited or allow only a certain number of pages to be printed.
This may well be a sledgehammer solution to your problem as I've no idea of Adobe's pricing for this product or whether is's practical for a small number of documents. It's used by the likes of the British Library (until recently anyway) for electronic inter-library loans which expire after 2 weeks and only allow the article to be printed once.
Even if you can do this, you can't stop user from makeing screenshot and then printing an image or something like that. If user can see data, you can not stop him from makeing a copy, so my advice is "don't even try". Make a noticeable warning that pdf should be printed only once and leave it like that, because if user want's to print it two times he/she will find the way.
I'd say this is not only impossible technically speaking, but also, impractical.
What's stopping the user from photocopying the document right after printing it ?
What is it that you're trying to accomplish by this, apart from gather a few novel suggestions ?
If you can print once, you can print an infinite number of times.
Consider a network printer: the raw data to be printed has to be sent to a remote embedded device, which your program would have no way of restricting, even if it somehow assumed ownership of the user's entire machine (which would already be considered extremly offensive; see the Sony rootkit scandal for the kind of reaction to expect).
How could you tell the device the user's machine is talking to is a real HP LaserJet, instead of something which pretends to be one (or, even simpler, pretends to be a remote spooler), but which saves the raw PCL/PS/whatever instead of printing it? Since that data is all that is needed to print the job, one would just have to replay it several times to a real printer to get several copies. You could also use a sniffer (as @dlamblin mentioned) and save the trouble of emulating the printer.
You could think of forbidding network printers, but having only network printers in an office (not simple printers attached to a general-purpose PC, but large printers plugged directly into the Ethernet switch) is not that uncommon. Because of that, several of your users (how many would depend heavily on the target demographic) would not be able to print, which is not good PR.
And even USB is not immune (though it would need more technical knowledge and perhaps special hardware); there exist USB sniffers. And even without them, a usb printer "gadget driver" on an embedded Linux device could be enough (note, however, that as of this writing I know of no usb printer gadget driver for Linux).
This is all assuming the program has somehow managed to obtain complete control of the user's machine. As the several failed attempts at copy protection show, this is easier said than done. How can you know that the printer driver you are using is just an uncommon version of the printer driver for a popular brand of printers, and not a hacked version to save the stream to the disk? How can you know there is no driver somewhere in the printing stack logging all the USB transactions to disk? And how can you differentiate a normal user of virtual machines from someone using them to intercept the communication with the USB devices?
All that said, you do not need to go that far. Most people, even if they have the technical know-how, will not attempt to bypass even the weakest attempts at preventing duplicate printing you make. In fact, I would not be surprised if most users would voluntarily not print more than once if told the file must be printed only once (but then there would be more cases of people accidentally printing twice). So, make a simple program which prints once and then erases the original data. Warn the user that the data will be erased after being printed once. And accept that some people will print more times than you allowed, and that some people will print less times than you allowed (power glitches, defective printers, misconfigured systems, or the dreaded PC LOAD LETTER can all cause the printing to fail). Be prepared for that.
For people who print more times than allowed, just accept the losses, the same way a physical shop has to accept that a fraction of its stock will be accidentally damaged or lost in some way. Have some way of finding the biggest abusers and dealing with them (the legal system seems to be a popular choice).
For people who print less times than allowed, something like phone support where the user can request a new copy would be an option (it works for Microsoft, right?). Of course, some people will abuse this, but see the previous paragraph.
The idea that a software program can control that a user only prints something once is a flawed idea. Think about paper jam - just because some application or operating system successfully have sent of a printing job to the printer does not guarantie that the user gets a copy. So what should the user do then?
Or what about the printer being configured to print X copies of each sheet? What about scanners or photo copiers?
And finally, while there obviously is no benefits from the user's point of view for such an anti-feature, I have absolutely no idea what the benefit should be for your company. Could you please explain what excatly what the benefit for doing such a thing is?
I know that many event tickets delivered as PDF don't worry very much about this. Instead, they assert very strongly that the venue will be scanning the barcodes, and that only the first copy of a given ticket will be allowed through the door. They also have a tendency to print the purchaser's name on the ticket, making it possible to ask for ID at the door as well.
Fundamentally, I don't think it is possible to make a print-once PDF file. And even if it was, I'd suspect that the customer relations cost from print problems and bad word-of-mouth would cost more that its worth.
TurboTax (a US Federal and State income tax preparation tool for the non-US readers) tried something similar a couple of years ago. They decided that it must only be possible to install the program once with printing enabled, which was enforced by an activation code from their server. It turns out that a significant number of their customers were in the habit of doing taxes at home, but installing a temporary copy at their office to take advantage of the available office printers. There was also a loud complaint from people concerned that about being able to reinstall that year's software later to fix the return if an audit revealed an issue.
The complaints were loud enough that no subsequent version has had these restrictions.
I cannot find any Adobe PDF feature that counts the number of times the document is printed. I only find disabling all printing. This makes sense when taken with the following in view:
If I were the PDF pirate you fear, and you created this elusive print-once PDF, I would merely send it to my printer, once.
Whereupon:
On a Mac I would choose to preview the printout before clicking "print", and save the PDF preview it generates.
On a PC I would ask the printer driver to also spool the job to a file.
Or on either I would choose a print-to-file driver, many of which are free.
And if none of these above options were available to me, I could ask my printer driver for many models to also spool the PostScript to disk first, or in dire cases, sniff the network traffic to the printer off of the network. It's generally not authenticated or encrypted. The PostScript could even be distilled back to PDF if need be.
Edit:
Even with the java printing applet that Pitney-Bowes uses to print postage, which seems to disable the preview option I've saved the resulting print job for reprinting. But I don't use this option any more because it simply cannot seem to print correctly on any kind of paper size, it's always printing the bar code off the margins of the page, even when I play it straight with the print-once intent.
The scenario we have is related to voucher/coupon printing. Basically, the client needs to ensure a user only has one copy of the voucher. Having validation at redemption (in store) isn't an option, so it needs to be at the time of printing the voucher.
Did you consider personalising the prints, requiring some id (and maybe some signature) when using the print in a store, and leave it up to the sales agreement that only a single copy is to be used? Then you'd need some final processing (at some later time), to register what vouchers have been used multiple times, and (threaten to) bill the customer for that... (This could even be an additional thing, next to trying to limit the number of prints.)
Note that not everyone has a quality printer. Some scans or photocopies may look better than some original printouts.
Also, like @RBerteig already noted, some customers may not even have a printer at all, or may have run out of ink. How would they print at some neighbour or at work when your solution needs additional software, like (the horrible, in my opinion) Adobe Digital Editions? Extending on that: what will the electronic voucher be like? I think you'll be implementing some online validation at redemption in the next release, for those showing you some barcode on their smartphone rather than some paper voucher.
We're aware the whole concept has fundamental flaws, but we basically want to make it as hard as possible for average Joe to print off more than 1.
[..]
Problem is, a competitor has produced a number of solutions, through ActiveX controls, and dedicated apps you have to install to handle all this, we're just trying to find a more elegant solution.
Ok, it's clear that you will eventually implement some solution that will not be very secure. I guess you'll have some written statement for the client about the risks. I suggest that in that written statement you also show the customer how easily that competitor's solution can be used to print multiple copies.
I am not a techie but it might be worth your while to check out the "Globe and Mail" (Canada) website. This is a newspaper which charges for the number of print copies -anything from one to hundred. You may be able to adapt whatever they have done to your own problem. The reason I am looking at this site is because i am about to launch a website and want to protect my content. Good Luck
We've done things like this with watermarks. The PDF always has a watermark except for some given "event" that will allow the user to print (like payment in our situation). Then we re-render the PDF without the watermark.
Not exactly what you're after, but perhaps the watermark notion could be helpful?
Try this tutorial from Adobe:
You can prevent users from print a PDF form. You can specify whether the form can be printed, printed with minimal resolution, or printed with a high resolution output.
1.Select File > Form Properties.
2.Click the PDF Security tab.
3.In the Permissions area, select Use A Password To Restrict Printing And Editing Of The Document And Its Security Settings.
4.In the Printing Allowed list, select one of the following options:
•None
•Low Resolution (150 dpi)
•High Resolution
"Hmm", (as Deep Thought said), "Tricky"
How about distributing access to a web site with a simple log-in requirement that contains the voucher. Print the voucher from the webpage.
Set the site up so that the user can log-in only once.
You might be able to set the site up so that the voucher does NOT show on the web page - though I do not know how to do this. If you can do this, you prevent the user from downloading and making multiple prints.
If something goes wrong with the log-in, provide a legitimate, but not too easy, way to get another log-in.
Of course, you could always mail a physical voucher to the recipient.
If you are concerned about photocopies, there are ways to prevent that - look a medical prescriptions that use "secure paper" for an example.
