1

I understand that encryption is the highest form of security for document/data storage.

While a password-protected document is more secure than one without password protection, if the document is sent via email that is NOT encrypted, is the document considered secure?

  • 3
    Depends on if it's password protected against opening or just editing, how strong the encryption used by the authoring program is, how strong the password is, and how securely the password is transmitted if it is also sent to someone else. – Alexander O'Mara May 5 '16 at 21:11
  • 2
    Also the version of Office. The old ones (98 certainly, I think 2000 too) just put a "password protected" record at the start of the file and didn't actually encrypt the data. – Polynomial May 5 '16 at 21:21
4

It's really broad to ask about whether a document is considered "secure". Something that is "secure" enough for me, sending a love poem to my girlfriend, is not "secure" enough for Obama, sending a love poem to Putin.

As Alexander O'Mara mentioned in a comment, there are different ways of setting a password on a file.

Excel gives you several ways to protect a workbook.

You can require a password to open it, a password to change data, and a password for changing the file's structure—adding, deleting, or hiding worksheets.

You can also set a password in Backstage view that encrypts your workbook.

Remember, though, that this type of protection doesn't always encrypt your data - only the encrypting password created in Backstage view does that. Users can still use third-party tools to read data that isn't encrypted. (from here )

So it seems that simply password protecting an excel file would not be very "secure", as someone might still be able to view the data with a third party tool.

That said, assuming you want edit protection, it again depends what you later do with the password, or how you would transmit it to the person later using it.

  • 2
    Edit protection is basically worthless, open protection in modern versions at least uses AES if I'm not mistaken, so it depends on the strength of the password. – Alexander O'Mara May 6 '16 at 2:11
  • 1
    It's very easy to by-pass the password access with .NET. We regularly extract data from password protected excel files and didn't even realize it had this "protection" in place until recent manual inspection for testing. – Dave May 6 '16 at 17:45
  • @Dave The spreadsheets you were bypassing were just protected with an 'open' password or were they protected with the Backstage-view password? – sscirrus Dec 2 '16 at 18:13
  • @sscirrus Not sure at this point... This info was relayed from another developer... so it's possible he was confused about how it was actually protected. OpenXML was used in the app though. – Dave Dec 20 '16 at 16:36
-2

Excel is totally insecure as it does not take long to find a password by brute force methods. For example in vba:

Sub PasswordBreaker()
 'Breaks worksheet password protection.
 Dim i As Integer, j As Integer, k As Integer
 Dim l As Integer, m As Integer, n As Integer
 Dim i1 As Integer, i2 As Integer, i3 As Integer
 Dim i4 As Integer, i5 As Integer, i6 As Integer
 On Error Resume Next
 For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
  For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
   For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
    For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
     ActiveSheet.Unprotect Chr(i) & Chr(j) & Chr(k) & _
       Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
       Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
     If ActiveSheet.ProtectContents = False Then
       MsgBox "One usable password is " & Chr(i) & Chr(j) & _
        Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
        Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
       Exit Sub
     End If
     Next: Next: Next: Next: Next: Next
  Next: Next: Next: Next: Next: Next
End Sub

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.