1

How easily could someone break into a password protected text file like Word?

  • have you googled "how to crack a Word password"? – schroeder May 7 '17 at 14:21
  • 2
    Why not use keepass2 or a similar password manager? It's designed for storing passwords in a file protected by a master password. – CodesInChaos May 7 '17 at 18:03
8

For modern versions of Word (Word 2007 and later), it appears that Microsoft has got the encryption pretty much right: They use multiple iterations of SHA-1 (since Office 2013, this has been replaced with SHA-512) for key derivation, and they use AES with a 128-bit key for encryption, compared to the older schemes that used everything from a 16-bit key to a 40-bit key. So if you are using Word 2007 or later, and ideally Word 2013 or later, it should be reasonably secure. Formats compatible with versions prior to 2007 will not be secure at all.

However, at least historically, Word has been known to litter temporary files all around itself while you are working on a document. I'm not sure if this is still the case, but remember that Word is a word processor; it's not really designed to keep secrets against a determined adversary who has access to your system. The document password protection only really helps if the adversary can get their hands only on the intentionally saved document file, and nothing else. There are many threat models where this protection would not be sufficient, and many of those would seem to apply to lists of passwords.

So it stands to reason that you could get reasonable protection against certain threats by keeping your passwords in an encrypted document maintained in a recent version of Word making sure to use non-backward-compatible formats.

On the other hand, by using a tool specifically designed to securely keep a list of passwords, you get one that is much smaller (thus far less risk of a bug having crept in, and far more likely for a compromising bug to be taken seriously), tailored for the purpose (thus far less likely to litter plaintext all around), and intended for the purpose (thus likely has useful features such as the ability to generate passwords, set password expiration dates, etc.). That's a password manager.

I discuss this also on my personal web site, where my recommendation is to use a password manager. (Actually, that's currently my second top advice, second only to do not share your passwords with anyone.)

Whichever way you go, wherever you store your list of passwords will require a high-grade passphrase. Remember that anyone who is able to guess that password will have access to all of your accounts; treat it accordingly. I suggest reasonably long Diceware passphrases (also) for this.

  • i can't belive word is actually decent about this! good info, thanks for sharing. – dandavis May 8 '17 at 4:46
  • 1
    Related and highly highly useful info: it appears that LibreOffice offers a very high level of security - askubuntu.com/questions/827178/… – Gabriel Staples Jul 9 '19 at 23:59
1

Some programs are made for encryption. Other programs are not.

Microsoft Office products' password-protected features (such as preventing certain spreadsheet cells from being edited, or a document from being viewed) are historically meant as convenience features. In 2003, the average office worker wouldn't open documents with special software to get around limitations. These days, such knowledge has matured and tools have been made widely available.

I don't know what the current state of affairs is in Microsoft Office Word, but I'd generally recommend to use special purpose software, i.e. a password manager. They are made to be secure and have features such as automatically erasing keys from memory.

To generally answer your question though: it could be secure, provided that the software you use does proper encryption. Encrypting a document with WinRAR would be secure, for example. But it's just a lot easier to use software that was made for this purpose, like KeePass.

  • Office 2007 and later uses iterated SHA-1 (later SHA-512) for KDF and AES-128 for encryption, at least according to Wikipedia. Bypassing that would be reasonably non-trivial. If you are using a different tool to encrypt and decrypt the document (such as your suggested WinRAR) then you have the problem that a plaintext version will necessarily exist somewhere, and will be recoverable using widely available data recovery tools. – a CVn May 7 '17 at 14:05
  • @MichaelKjörling I read about MS Office in your answer (and upvoted) after posting this. And regarding having plaintext copies around, that's why I recommend using a password manager. – Luc May 7 '17 at 14:17
0

For storing passwords you should use file formats and software designed for this purposes. One popular tool is KeePass2. Use good passphrase and increase default iterations number and you will make life of potential breaker much harder.

--t.

0

The op's question is, how easy is to break a password protected word file? Just google that phrase to see it is a real trivial matter to open. There is tools specifically designed to remove the password from office files. Tegoo is correct to use a program designed for passwords.

-2

For storing the password you are using password protected file and it is not safe. You should try https://www.truekey.com/ for storing the password as it is the product of Intel. In this you just need to remember the master password only and your other password should be managed by TrueKey itself.

  • 1
    Given the Intel AMT vulnerability I'm sure sure I'd call them security focused. KeePass2 is a better option IMHO. – Tim May 8 '17 at 1:11
  • 1
    Intel is in the business of making CPUs and related hardware, and software when it is required to make the hardware work. Also, instead of just pointing at a different product (which can be borderline spam), you should elaborate on why "storing [passwords] [in a] password protected file [...] is not safe". – a CVn May 8 '17 at 5:39
  • 3
    Why promote this specific product and not password managers in general? – schroeder May 8 '17 at 6:33
  • While I'm not fond of this answer, True Key actually seems like a fairly decent password manager. I read the white paper available on their website and at least on the surface it seems like they've made a lot of good design decisions including client-side encryption, a reasonably strong KDF, etc. My wife "upgraded" to True Key after Intel bought out and dropped support for PasswordBox and for the most part it's been pretty smooth sailing, at least smooth enough to make her uninterested in looking at any other options, many of them more expensive or complicated. – Ben May 8 '17 at 17:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.