4 ms·
Emailing yourself password-protected MS Office files isn't much secure either (unless something has changed in 2010 version). I've routinely cracked passwords f
by chime 14y ago
Emailing yourself password-protected MS Office files isn't much secure either (unless something has changed in 2010 version). I've routinely cracked passwords for my users using freely available tools when they couldn't remember the password to unprotect an Excel workbook.
- nhebb 14y agoWhich version of Excel were you working with? Security was greatly increased in Office 2007. http://serverfault.com/questions/122627/how-secure-is-the-encryption-used-by-microsoft-office-2007 http://serverfault.com/questions/122627/how-secure-is-the-en...
- tedunangst 14y agoWere their passwords more complex than "secret"? There is a known flaw that Office uses (used? I believe it's unfixed) the same RC4 stream for multiple versions of a document, which could be bad news if you used the same password for them and an attacker has old revisions, but even so, that may be hard to leverage if the doc in question is just a list of passwords. [nm, it's been fixed for a while. thanks, nhebb.]
- yuhong 14y agoThere was two RC4 keystream reuse flaws in the Office binary formats. One involved salt reuse on save (an implementation bug) and was fixed in Office 2007. But there is still another one that can't be fixed without changing the file format. The original Office 2007 file formats used AES-ECB, but later switched to CBC in SP2.