0

I'm here to consult those who know more about encryption issues, since I do not have much knowledge on the subject.

A few years ago, I acquired a program that allows me to store information in a single file. The program had to protect the folders with password, and I was putting it to the test, until I discovered how to access that information (supposedly encrypted) without entering the password.

This is where I ask how is it possible that I could access the information through the same program and without entering the password if the file is encrypted? Should not I have obtained illegible information?

As far as I know, by entering the password, the file is decrypted and readable. But in this case, the developer says it uses encryption and I managed to access the information without the password. What he says is not real? There are different types of encryption?

closed as unclear what you're asking by Anders, Xander, forest, Steffen Ullrich, Rory Alsop Jan 12 at 23:37

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately nothing is known about the program you were using and what the authors of the program claim the program is doing vs. what you understand this program should do vs. what the program is really doing. Based on this lack of information it is impossible to say what's going on. – Steffen Ullrich Jan 12 at 10:06
  • @SteffenUllrich Thank you! The truth is that I asked and I was not so sure because I suspected that they would answer something like that. The reason why I do not give the name of the program is because I am the only one who has discovered the BUG and although it was corrected, the previous versions can be used in a malicious way with the people who have stored important information. And on the other hand, I'm not sure the developer agrees to share this BUG. – MarianoM Jan 12 at 10:59
  • Your comment suggests to me that your question is about a bug which was acknowledged by the developer and where you want to know how such a bug could happen. But I did not understand your question the same way. Anyway, there are still too few details to determine what could have happened. But, if the developer of the product acts responsible he should inform all the customers about the problem and ideally also provide sufficient details in which circumstances the issue could happen so that the customers are able to determine if their data was at risk. – Steffen Ullrich Jan 12 at 11:07
  • @SteffenUllrich I agree with you and this is something that worries me for those who trust him fully. As soon as I discovered it, I reported it and asked if it was going to give explanations, but it only said that it launched the update that corrects the failure and informed in the changelog that the update is a high priority since a malicious user could access the protected folders by passwords. Even so, this worries me because although the new versions are corrected, I think you can still access it from old versions (I have to confirm it). – MarianoM Jan 12 at 11:29
  • @SteffenUllrich I just confirmed that with the previous versions of the software you can access the information protected by password as you suspected. To solve this and not be accessible with any previous version, the developer should change the format of the database or provide a fix for the user to apply to it. I suspect that it is a very serious failure and that you should solve it in this way so that in none of the previous versions can you view the information without entering a password. What would you do in my place? – MarianoM Jan 13 at 17:20
1

If you can read it without the password either it is not encrypted or the encryption is key is not tied to the password. I had seen such a thing in an Android app. User data was encrypted and stored in the DB. When activity B is opened data was decrypted and displayed to the user. To be able open activity B you had to enter a password on activity A. If the password is correct activity A starts activity B. But when a root user force opens the activity B data is still decrypted and displayed to the user. We don't have enough info to answer your question but it could be something like this.

  • Interesting information, Thank you very much! It could be something similar, but I really asked because I thought it was something very simple to deduce and I wanted to read expert opinions; I see that it is more complex than it seems. I do not share more information because I am the only one who knows the BUG and I fear that previous versions of the program will be used to access confidential information of the people who use it. And on the other hand, I'm not sure the developer agrees to share this BUG. – MarianoM Jan 12 at 11:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.