0

I'm here to consult those who know more about encryption issues, since I do not have much knowledge on the subject.

A few years ago, I acquired a program that allows me to store information in a single file. The program had to protect the folders with password, and I was putting it to the test, until I discovered how to access that information (supposedly encrypted) without entering the password.

This is where I ask how is it possible that I could access the information through the same program and without entering the password if the file is encrypted? Should not I have obtained illegible information?

As far as I know, by entering the password, the file is decrypted and readable. But in this case, the developer says it uses encryption and I managed to access the information without the password. What he says is not real? There are different types of encryption?

Improve this question
10
  • Unfortunately nothing is known about the program you were using and what the authors of the program claim the program is doing vs. what you understand this program should do vs. what the program is really doing. Based on this lack of information it is impossible to say what's going on.
    – Steffen Ullrich
    Commented Jan 12, 2019 at 10:06
  • @SteffenUllrich Thank you! The truth is that I asked and I was not so sure because I suspected that they would answer something like that. The reason why I do not give the name of the program is because I am the only one who has discovered the BUG and although it was corrected, the previous versions can be used in a malicious way with the people who have stored important information. And on the other hand, I'm not sure the developer agrees to share this BUG.
    – MarianoM
    Commented Jan 12, 2019 at 10:59
  • Your comment suggests to me that your question is about a bug which was acknowledged by the developer and where you want to know how such a bug could happen. But I did not understand your question the same way. Anyway, there are still too few details to determine what could have happened. But, if the developer of the product acts responsible he should inform all the customers about the problem and ideally also provide sufficient details in which circumstances the issue could happen so that the customers are able to determine if their data was at risk.
    – Steffen Ullrich
    Commented Jan 12, 2019 at 11:07
  • @SteffenUllrich I agree with you and this is something that worries me for those who trust him fully. As soon as I discovered it, I reported it and asked if it was going to give explanations, but it only said that it launched the update that corrects the failure and informed in the changelog that the update is a high priority since a malicious user could access the protected folders by passwords. Even so, this worries me because although the new versions are corrected, I think you can still access it from old versions (I have to confirm it).
    – MarianoM
    Commented Jan 12, 2019 at 11:29
  • @SteffenUllrich I just confirmed that with the previous versions of the software you can access the information protected by password as you suspected. To solve this and not be accessible with any previous version, the developer should change the format of the database or provide a fix for the user to apply to it. I suspect that it is a very serious failure and that you should solve it in this way so that in none of the previous versions can you view the information without entering a password. What would you do in my place?
    – MarianoM
    Commented Jan 13, 2019 at 17:20

1 Answer 1

Reset to default
1

If you can read it without the password either it is not encrypted or the encryption is key is not tied to the password. I had seen such a thing in an Android app. User data was encrypted and stored in the DB. When activity B is opened data was decrypted and displayed to the user. To be able open activity B you had to enter a password on activity A. If the password is correct activity A starts activity B. But when a root user force opens the activity B data is still decrypted and displayed to the user. We don't have enough info to answer your question but it could be something like this.

Improve this answer
1
  • Interesting information, Thank you very much! It could be something similar, but I really asked because I thought it was something very simple to deduce and I wanted to read expert opinions; I see that it is more complex than it seems. I do not share more information because I am the only one who knows the BUG and I fear that previous versions of the program will be used to access confidential information of the people who use it. And on the other hand, I'm not sure the developer agrees to share this BUG.
    – MarianoM
    Commented Jan 12, 2019 at 11:04

Not the answer you're looking for? Browse other questions tagged .