Earlier quoted context omitted.
Sometimes document provenance matters and you don't want a copy.
Hmm. I don't really get that. If document provenance matters, don't you want to keep it read only?
Or append-only (think Git)
OfficerBreaker – pptx/docx/xlsx password remover
21–30 of 30 posts
Re: OfficerBreaker – pptx/docx/xlsx password remover
#22Nice. In older versions of xlsx they used a weird hash function with tiny hash space that could be brute-forced in I knew about the xml trick, but I could never get it to work consistently. This looks useful, thanks for sharing.
Re: OfficerBreaker – pptx/docx/xlsx password remover
#23Note: this is only for write protection passwords. Files that require a password to read are actually encrypted. I think any password that would prevent editing but allow reading would necessitate a fairly complex digital signature management scheme for data provenance (which might be useful in some settings).
I feel like a hash of the contents + some secret bytes could be a convincing signature that only the owners of the secret bytes could author.
Alternatively, hash the contents and signed using asymmetric keys. This would allow for non private key owners to validate the integrity
Re: OfficerBreaker – pptx/docx/xlsx password remover
#24Note: this is only for write protection passwords. Files that require a password to read are actually encrypted. I think any password that would prevent editing but allow reading would necessitate a fairly complex digital signature management scheme for data provenance (which might be useful in some settings).
I feel like a hash of the contents + some secret bytes could be a convincing signature that only the owners of the secret bytes could author. Alternatively, hash the contents and signed using asymmetric keys. This would allow for non private key owners to validate the integrity
> I feel like a hash of the contents + some secret bytes could be a convincing signature that only the owners of the secret bytes could author.
How would you validate the signature?
Re: OfficerBreaker – pptx/docx/xlsx password remover
#25I know this may be slightly off topic as this specifically deals with the modify, not the access password. But Office for Mac still limits access passwords to 15 characters, my understanding is that this is a significant weakness for documents saved from Office for Mac. Does anybody have any insights into how big of an attack vector this actually is?
Re: OfficerBreaker – pptx/docx/xlsx password remover
#26This password specifically refers to "Password to Modify" and Excel 2019 / 365 clearly warn in the reenter password popup: > Caution: Password to modify is not a security feature. ... Malicious users can edit the file and remove the password. This type of "protection" is also present in the VBA blobs (where you can change a few bytes and work around the VBA protection) Saving a file with a password to open actually e…
In other words, not much different from PDF's permissions feature.
Does PDF has a default password?
Re: OfficerBreaker – pptx/docx/xlsx password remover
#27Some «security» features dont need to be secure. This is obviously one of those as the data is readable by all, but only modifiable by «those in the know», but if someone does anyway who cares. I’ve done hardcoded frontend identity whitelists for authorization. Some times it’s fine to let hackers access stuff, but not the vanilla mass-market browsers. Feature flags etc
Actually, I think this one is better if it isn't perfectly secure. I make spreadsheets with passwords just so people won't go in there and accidentally delete something or make other silly mistakes. I'm not trying to hide anything or keep it safe from the outside worldor anything. Every once in a while I forget one of the passwords or set it up with a typo or something, and I have to crack it. I'm sure there's loads of people doing something similar. For me, the weak security on this particular password is a feature.
Re: OfficerBreaker – pptx/docx/xlsx password remover
#28Re: OfficerBreaker – pptx/docx/xlsx password remover
#29Earlier quoted context omitted.
I feel like a hash of the contents + some secret bytes could be a convincing signature that only the owners of the secret bytes could author. Alternatively, hash the contents and signed using asymmetric keys. This would allow for non private key owners to validate the integrity
> I feel like a hash of the contents + some secret bytes could be a convincing signature that only the owners of the secret bytes could author. How would you validate the signature?
Parent is describing a keyed HMAC scheme. JWTs sometimes use them, but key management is a massive PITA.
Re: OfficerBreaker – pptx/docx/xlsx password remover
#30Hopefully no one treated these passwords as an actual security feature.
I have some bad news for you. I know of at least 2 occasions.