Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Excel VBA Password Protection is useless

blog.nig.gl

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Excel VBA Password Protection is useless

#11

Post by ryandrake »

yuhong wrote: post #8
AckermanMD wrote: post #3

And it's equally trivial to "recover" a password on most Microsoft Access databases with Access PassView: http://www.nirsoft.net/utils/accesspv.html While some would argue that any "security" is better than no security, I would disagree. Making a user believe that there is security when it is trivial to break it is worse than no security at all.

In the MDB format used in Access 2003 and older. BTW the user-level security and what was called "encryption" that was also supported in MDB format is no better. This encryption (which was based on 32-bit RC4) was so weak it was renamed "encoding" in Access 2003. All of these was ditched with the Access 2007 ACCDB format and replaced with real encryption based on CryptoAPI RC4 encryption (as termed is MS-OFFCRYPTO) i…

Any encryption method we come up with today can be considered "encoding" in the future, given enough time.

Re: Excel VBA Password Protection is useless

#12

Post by dspillett »

AckermanMD wrote: post #3

And it's equally trivial to "recover" a password on most Microsoft Access databases with Access PassView: http://www.nirsoft.net/utils/accesspv.html While some would argue that any "security" is better than no security, I would disagree. Making a user believe that there is security when it is trivial to break it is worse than no security at all.

While leading the user to think they are more secure than they are is definitely a bad thing, you are right there. If we are honest about the level of security offered (a message to the effect that "this will only deter opportunistic viewers, for full security please use a proper encryption method" - or how ever you'd word that for the man-on-the-street)then user will either find an alternative or decide it is worth while (or decide they don't care).

One thing that makes this "security" better than no security at all is that the reader has to purposefully takes steps to read the content so they can't try use any sort of "I saw that information accidentally" defence if called to task about knowing something they shouldn't (or passing that information on to someone else).

Re: Excel VBA Password Protection is useless

#15

Post by acchow »

ryandrake wrote: post #11
yuhong wrote: post #8

Earlier quoted context omitted.

In the MDB format used in Access 2003 and older. BTW the user-level security and what was called "encryption" that was also supported in MDB format is no better. This encryption (which was based on 32-bit RC4) was so weak it was renamed "encoding" in Access 2003. All of these was ditched with the Access 2007 ACCDB format and replaced with real encryption based on CryptoAPI RC4 encryption (as termed is MS-OFFCRYPTO) i…

Any encryption method we come up with today can be considered "encoding" in the future, given enough time.

Except possibly AES.

http://security.stackexchange.com/a/25392

Re: Excel VBA Password Protection is useless

#16

Post by yuhong »

vonuebelgarten wrote: post #13

Also, Outlook 2003¹ PST files, also when created with the "strong encryption" option, are no more then obfuscation. libpst convert them to MH with no worries. [1] Not that updated, I know, but I do not use Outlook since then.

AFAIK the newer versions of Outlook still use the same format. And the PST password is just as useless too.
Post reply on HN