Results 1 to 15 of 15
  1. #1
    Platinum Lounger
    Join Date
    Feb 2001
    Location
    Yilgarn region of Toronto, Ontario
    Posts
    5,453
    Thanks
    0
    Thanked 0 Times in 0 Posts

    project passwords (VBA any)

    (Moderator, please move this to a more general forum if applicable).

    I have about 60 projects, each one password protected. I use a document with a 60-row 2-column table as my memory, and no, it is not saved as Passwords.doc!

    A thought came to me today: I could set the passwords to be suitably long and uncrackable by using a choice phrase, such as "IHaveForgottenThePassword" and including the project name within the phrase, thus: "IHaveForgottenTheBulkrPassword" and "IHaveForgottenTheIdentPassword" and "IHaveForgottenTheHazltPassword" etc.

    What's the drawback?

    My mode of operation when off site is to be sitting with the client. If the application crashes, I quickly type the password and the user/client can't see what I'm typing in the few seconds it takes.

    The phrase doesn't need to include "password", of course; a phrase such as "herewegoagain" would work as well, as would "iwasborninthe 6thmonth" (note the space), and so on.

    Easy to remember, easy to fabricate.

  2. #2
    WS Lounge VIP rory's Avatar
    Join Date
    Dec 2000
    Location
    Burwash, East Sussex, United Kingdom
    Posts
    6,280
    Thanks
    3
    Thanked 191 Times in 177 Posts

    Re: project passwords (VBA any)

    If you are talking about VBA project passwords, then commercial crackers don't crack the password as such - they simply remove it and do so instantaneously; it doesn't matter how long or complicated it is!
    Regards,
    Rory

    Microsoft MVP - Excel

  3. #3
    Platinum Lounger
    Join Date
    Feb 2001
    Location
    Yilgarn region of Toronto, Ontario
    Posts
    5,453
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: project passwords (VBA any)

    > If you are talking about VBA project passwords,
    Yes, but more than that. Passwords in general, even.
    My passwords document lists about 40 services (mail accounts, blog subscriptions etc), each with its own password.
    It seems to me that a general technique as I outlined - that of using a chosen phrase augmented by the product/service identifier - provides a reasonably secure password; probably more secure than my habit of carrying the passwords document with me on a memory key, from time to time.

    My services passwords might be, by example, "IHaveForgottenTheGmailPassword", "IHaveForgottenTheWoodysPassword" and "IHaveForgottenTheYahooPassword".

  4. #4
    WS Lounge VIP rory's Avatar
    Join Date
    Dec 2000
    Location
    Burwash, East Sussex, United Kingdom
    Posts
    6,280
    Thanks
    3
    Thanked 191 Times in 177 Posts

    Re: project passwords (VBA any)

    For passwords in general, then yes, the longer and more complicated the better, subject to the limitations of the service you are using (not all allow punctuation for example). Certain types of service, however, have flaws which make the length of your password pretty much irrelevant, after a certain point. Also, things like Office docs can be decrypted instead of breaking the password.
    Regards,
    Rory

    Microsoft MVP - Excel

  5. #5
    Plutonium Lounger
    Join Date
    Nov 2001
    Posts
    10,550
    Thanks
    0
    Thanked 7 Times in 7 Posts

    Re: project passwords (VBA any)

    Chris,

    This is not a very good idea, because if any one of your passwords is ever compromised then someone will be able to guess all the others, you might as well make them all the same! This could be a significant risk if you use this technique for passwords that protect your access to web sites, where they may be availble to people you have never met and may not be able to fully trust.

    StuartR

  6. #6
    Platinum Lounger
    Join Date
    Feb 2001
    Location
    Yilgarn region of Toronto, Ontario
    Posts
    5,453
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: project passwords (VBA any)

    > if any one of your passwords is ever compromised then someone will be able to guess all the others
    True.
    I'm struggling with the costs (in terms of compromise) of someone peeking over my shoulder and "reading" what I type on the keyboard, against the cost of someone gaining access to a rather lengthy "passwords.doc" which I lug around with me.
    The basic need is for on-the-road access to the many templates & libraries I own.
    Most of my web-access-maintenance is done from the home office where security is pretty tight.

    My thoughts had run along the lines of "what can i fabricate from almost nothing".
    I think you are saying that "anything that Chris can work out can be worked out by anyone else".

  7. #7
    Plutonium Lounger
    Join Date
    Nov 2001
    Posts
    10,550
    Thanks
    0
    Thanked 7 Times in 7 Posts

    Re: project passwords (VBA any)

    > I think you are saying that "anything that Chris can work out can be worked out by anyone else".

    If you go for the kind of simple substitution you were talking about earlier, then even my cat could work it out.

    You'd be better off having one really strong password that you use for all of them. By really strong I mean something that includes mixed case letters, numbers and punctuation marks, is at least 8 characters long, that you can remember easily, and that you can learn to type quickly and accurately to make it hard for someone to read over your shoulder. If you can think of something like this then gOf0riT!Chris

    StuartR

  8. #8
    Platinum Lounger
    Join Date
    Feb 2001
    Location
    Yilgarn region of Toronto, Ontario
    Posts
    5,453
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: project passwords (VBA any)

    > You'd be better off having one really strong password that you use for all of them.
    I've been using mnemonic passwords for about 7 years. Each application has a feature that reminds me of a place or incident in my childhood.
    Then I started dabbling in passwords based on the day and time, throwing up delightful strings such as "67ji3ktcwntk", with the advantage that an auxiliary macro "password of the date" would allow me to mystically re-create the "lost" password based on the time stamp of the file (Let's see, this template was saved on 1006 June 19, so the password must be .....")
    I know that what I have is pretty secure; I continue to search for something that is secure and is based on something that doesn't see me lug around a file of passwords.

  9. #9
    Platinum Lounger
    Join Date
    Feb 2001
    Location
    Yilgarn region of Toronto, Ontario
    Posts
    5,453
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: project passwords (VBA any)

    >you can learn to type quickly and accurately
    I maintain my passwords in a file. Cunningly named not "passwords.doc".
    I have begun a practice of copying (Ctrl-C) the password from the file, and pasting it (Ctrl-V) into the passwords dialogue. With a twist.
    I paste it a specific number of times, so that anyone stumbling across a password of, say "2zw9urd" will be misled into thinking that the password really is "2zw9urd", when in practice it is really "2zw9urd2zw9urd2zw9urd (assuming "3" as the paste-repetition.)

  10. #10
    WS Lounge VIP rory's Avatar
    Join Date
    Dec 2000
    Location
    Burwash, East Sussex, United Kingdom
    Posts
    6,280
    Thanks
    3
    Thanked 191 Times in 177 Posts

    Re: project passwords (VBA any)

    That would be a good added layer of security if you hadn't just revealed it on the internet! <img src=/S/grin.gif border=0 alt=grin width=15 height=15>
    Regards,
    Rory

    Microsoft MVP - Excel

  11. #11
    WS Lounge VIP rory's Avatar
    Join Date
    Dec 2000
    Location
    Burwash, East Sussex, United Kingdom
    Posts
    6,280
    Thanks
    3
    Thanked 191 Times in 177 Posts

    Re: project passwords (VBA any)

    I should also have mentioned in my original post that VBA project passwords don't even require commercial cracking software to break - you can do it yourself with a hex editor, so they really aren't secure at all.
    FWIW.
    Regards,
    Rory

    Microsoft MVP - Excel

  12. #12
    Platinum Lounger
    Join Date
    Feb 2001
    Location
    Yilgarn region of Toronto, Ontario
    Posts
    5,453
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: project passwords (VBA any)

    > That would be a good added layer of security if you hadn't just revealed it on the internet!
    It is an added layer of security. I only used "3" as an example. You still don't know whether I use 1, 2, 3, 4 or 5.

    >do it yourself with a hex editor.
    What the heck's a ... oh, never mind!(grin!)

    I started this thread as a means of clarifying my thoughts about others in my situation - a slew of projects for a slew of clients, my own stuff, on-line services etc.
    Password Manager doesn't cut it, because I'm often not at my own machine.
    I need a means (in my case I use a Word Document) to carry my passwords with me.

    > That would be a good added layer of security if you hadn't just revealed it on the internet!
    It is an added layer of security. I only used "Word Document" as an example. You still don't know whether I use text within a Word Document, text within an Excel Workbook, a macro to pop-up the password from a Word Document Module, and excel Module etc. etc.

  13. #13
    WS Lounge VIP rory's Avatar
    Join Date
    Dec 2000
    Location
    Burwash, East Sussex, United Kingdom
    Posts
    6,280
    Thanks
    3
    Thanked 191 Times in 177 Posts

    Re: project passwords (VBA any)

    My response was predicated on your statement that someone had found a password and would think that was it - now they will know to try repetitions! <img src=/S/smile.gif border=0 alt=smile width=15 height=15>
    I'm pretty sure there are password managers that you can carry around on a memory stick for precisely this purpose.
    Regards,
    Rory

    Microsoft MVP - Excel

  14. #14
    2 Star Lounger
    Join Date
    May 2002
    Location
    Johannesburg, Gauteng, South Africa
    Posts
    104
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: project passwords (VBA any)

    Hi Rory, et al,

    Does this still apply to Office 2007 and specifically VBA projects in Excel 2007 ?

    I know Excel 2003 VBA passwords could be cracked instantly for reasons you have already mentioned, but for example, Word 2003 document (not VBA) passwords were a different story and I think either a dictionary or some form of brute-force attack was required because these files were encrypted.

    In other words, is Excel 2007 VBA protection improved ? For a certain application I have created, I would risk VBA password protection if only a brute-force type of approach will crack it now, but if it can still be done instantly as for Excel 2003, then I will review my application structure.

    Thanks,

  15. #15
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: project passwords (VBA any)

    I don't know for certain (I don't have Office 2007) but there are tools that promise "instant removal" of VBA passwords in all versions of Office, including 2007, so it looks like VBA password security is no better in Office 2007 than in previous versions.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •