Solved

How secure is Access VBA Project Password?

Posted on 2004-09-27
15
913 Views
Last Modified: 2010-05-18
I need to know how securely the VBA project password is stored within Access.  Is it encrypted within the MDB?  How strong is any encryption? What differences are there in how this is done in various Access versions (A2K, Access XP, Access 2003)?  How easy is it to crack?  I'm planning on using a 16 character random alpha-numeric password.

My preference would be to use MDE, but we are having a bear of a time with Access XP versions, e.g. an MDE compiled on one version of Access XP will cause another version of Access XP to crash when the app is opened.  Until we get that figured out, I need to secure the code (thus understand how well the VBA Project Password works).

Thanks!
Teiwaz
0
Comment
Question by:teiwaz
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 3
  • 3
  • +2
15 Comments
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165437
Secure ?  nope

From Google...

Web  Results 1 - 10 of about 103,000 for access project password crack. (0.18 seconds)  

better than nothing however...
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165445
oh ...afaik...the length/complexity  of the pwd is irrelevant to someone with the crack tool...it apparently bypasses the pwd altogether...another hidden "feature" of access
0
 
LVL 77

Expert Comment

by:peter57r
ID: 12165450
Hello teiwaz,

The password is totally secure against users for whom access to the code would be of little or no interest.
It is totally insecure against users for whom access to the code would be worthwhile.
The same is true for all Access security.


Pete
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 36

Expert Comment

by:SidFishes
ID: 12165462
a recommendation to deal with the real problem of not being able to use an mde

get a developers edition of access and distribute the access runtime app to all users. This assumes that users have no need to edit or create anything....mde + runtime = nothing to look at and nothing to look at it with. plus the homongeneity of the app will eliminate the problem
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165465
probably should say...

app will HELP eliminate the problem

(runtime has it's own quirks as well)
0
 
LVL 8

Expert Comment

by:Benjamin_Luk
ID: 12165824
The best way should be : MDE, only this can do the safety security for code.

Best Regards

ben
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12165833
So what you are saying is that the password or its storage method is completely irrelevant, because Access provides an alternate way to get in, completely bypassing it?  Great!

On the runtime version, what issues will i run into distributing this when virtually all of my users have Access (full version) already installed?

Thanks!
Teiwaz
0
 
LVL 36

Accepted Solution

by:
SidFishes earned 300 total points
ID: 12166197
well..it's not completely irrelevant...but it depends on the situation. If this is an in house application, you're "probably" reasonably safe...for most users...simply entering their OWN pwd is a chore ....and anyone caught dl'ing a crack app on my network would be immediately canned...and would assume your co has a similar policy...that's enough to keep most other users inline...If it's a distributed app..i wouldn't rely on it for a second..

runtime _can_ coexist with full versions but it also might be worse than where you are now...

you might want to open a new q? and get some help diagnosing the root of the problem...i suspect reference issues...



 
0
 
LVL 41

Assisted Solution

by:shanesuebsahakarn
shanesuebsahakarn earned 200 total points
ID: 12166637
I would suggest looking into SageKey for Wise/InstallShield (www.sagekey.com) if you want to use the runtime - this makes coexistance much easier. Of course, that doesn't solve your problem - if the user also has a full version, they can just open your mdb file from their full version of Access.

I agree with Sid about references. You should check that all required OCX and DLL files exist on the target machines, with the correct versions. MS controls are particularly bad in this regard.
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12172532
OK, one last follow up question, and then I'll close this down and open one on the reference issues.

My users are using either Win2k or XP for their OS and either Office 2k or Office XP. Currently I am developing in Access 2k.  If I were to go with the runtime solution, which is more stable/fewer bugs/plays best with other installed versions of Access: Access 2k or Access 2002(XP)?

And one comment, I think there is a way to test in VBA if the application is runtime or not, so I could test for that and only allow users access if they are using the runtime version I installed.

Thanks again!
Teiwaz
0
 
LVL 41

Expert Comment

by:shanesuebsahakarn
ID: 12172577
Without a doubt, Access 2002. You can test your application by using the /runtime startup command line switch - this makes the full version simulate a runtime environment.
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12172736
we've got A2002 runtime deployed here...and it seems to be coexisting nicely with A97 & A2000

and to emphasize something that shane pointed out...using an installer is important, especially if you are using things like activex controls (date/timepicker etc) and dll's (commdlg etc.)

If you set up your installer script correctly, it will ensure that all the necessary file are included in the package...as well as taking care of registering the ocx's and dll's when necessary. You can also use it to install fonts (app specific such as barcode fonts etc)

I've not used wise or installsheild...but even the basic Package and Deployment wizard that comes with Dev Edition or Visual studio can do a good job...(has in my experience anyways...have heard that some have had problems...)

0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12172816
"way to test in VBA if the application is runtime or not,"

Dim x As Boolean
x = SysCmd(acSysCmdRuntime)
If x = True Then
MsgBox "It's Runtime"
end if

0
 
LVL 41

Expert Comment

by:shanesuebsahakarn
ID: 12172843
> has in my experience anyways...have heard that some have had problems

I think that in a standalone environment, the PDW is ok, it's just when it needs to install on a system that requires coexistance that it can fall over, especially with any OCXs and libraries. I use SageKey+Wise, and it's cut our problems virtually down to nil (at least, so far......!). Admittedly, several of the problems we encountered were when installing on machines with other runtimes on it.
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12173036
Thanks to you all.  I'm going to set the password for now and start looking into runtime 2002 and investigate how to get runtime installed with other versions of Access running.

FYI, I'm using Inno setup (open source setup that has so far worked very well).  I am not using any external tools (oxc, activeX or dll). I am using 3 libraries that I've built (mdbs).  

Thanks again!
Teiwaz
0

Featured Post

Enroll in June's Course of the Month

June’s Course of the Month is now available! Experts Exchange’s Premium Members, Team Accounts, and Qualified Experts have access to a complimentary course each month as part of their membership—an extra way to sharpen your skills and increase training.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In a multiple monitor setup, if you don't want to use AutoCenter to position your popup forms, you have a problem: where will they appear?  Sometimes you may have an additional problem: where the devil did they go?  If you last had a popup form open…
Access developers frequently have requirements to interact with Excel (import from or output to) in their applications.  You might be able to accomplish this with the TransferSpreadsheet and OutputTo methods, but in this series of articles I will di…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question