Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

How secure is Access VBA Project Password?

Posted on 2004-09-27
15
Medium Priority
?
928 Views
Last Modified: 2010-05-18
I need to know how securely the VBA project password is stored within Access.  Is it encrypted within the MDB?  How strong is any encryption? What differences are there in how this is done in various Access versions (A2K, Access XP, Access 2003)?  How easy is it to crack?  I'm planning on using a 16 character random alpha-numeric password.

My preference would be to use MDE, but we are having a bear of a time with Access XP versions, e.g. an MDE compiled on one version of Access XP will cause another version of Access XP to crash when the app is opened.  Until we get that figured out, I need to secure the code (thus understand how well the VBA Project Password works).

Thanks!
Teiwaz
0
Comment
Question by:teiwaz
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 3
  • 3
  • +2
15 Comments
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165437
Secure ?  nope

From Google...

Web  Results 1 - 10 of about 103,000 for access project password crack. (0.18 seconds)  

better than nothing however...
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165445
oh ...afaik...the length/complexity  of the pwd is irrelevant to someone with the crack tool...it apparently bypasses the pwd altogether...another hidden "feature" of access
0
 
LVL 77

Expert Comment

by:peter57r
ID: 12165450
Hello teiwaz,

The password is totally secure against users for whom access to the code would be of little or no interest.
It is totally insecure against users for whom access to the code would be worthwhile.
The same is true for all Access security.


Pete
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 
LVL 36

Expert Comment

by:SidFishes
ID: 12165462
a recommendation to deal with the real problem of not being able to use an mde

get a developers edition of access and distribute the access runtime app to all users. This assumes that users have no need to edit or create anything....mde + runtime = nothing to look at and nothing to look at it with. plus the homongeneity of the app will eliminate the problem
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165465
probably should say...

app will HELP eliminate the problem

(runtime has it's own quirks as well)
0
 
LVL 8

Expert Comment

by:Benjamin_Luk
ID: 12165824
The best way should be : MDE, only this can do the safety security for code.

Best Regards

ben
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12165833
So what you are saying is that the password or its storage method is completely irrelevant, because Access provides an alternate way to get in, completely bypassing it?  Great!

On the runtime version, what issues will i run into distributing this when virtually all of my users have Access (full version) already installed?

Thanks!
Teiwaz
0
 
LVL 36

Accepted Solution

by:
SidFishes earned 1200 total points
ID: 12166197
well..it's not completely irrelevant...but it depends on the situation. If this is an in house application, you're "probably" reasonably safe...for most users...simply entering their OWN pwd is a chore ....and anyone caught dl'ing a crack app on my network would be immediately canned...and would assume your co has a similar policy...that's enough to keep most other users inline...If it's a distributed app..i wouldn't rely on it for a second..

runtime _can_ coexist with full versions but it also might be worse than where you are now...

you might want to open a new q? and get some help diagnosing the root of the problem...i suspect reference issues...



 
0
 
LVL 41

Assisted Solution

by:shanesuebsahakarn
shanesuebsahakarn earned 800 total points
ID: 12166637
I would suggest looking into SageKey for Wise/InstallShield (www.sagekey.com) if you want to use the runtime - this makes coexistance much easier. Of course, that doesn't solve your problem - if the user also has a full version, they can just open your mdb file from their full version of Access.

I agree with Sid about references. You should check that all required OCX and DLL files exist on the target machines, with the correct versions. MS controls are particularly bad in this regard.
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12172532
OK, one last follow up question, and then I'll close this down and open one on the reference issues.

My users are using either Win2k or XP for their OS and either Office 2k or Office XP. Currently I am developing in Access 2k.  If I were to go with the runtime solution, which is more stable/fewer bugs/plays best with other installed versions of Access: Access 2k or Access 2002(XP)?

And one comment, I think there is a way to test in VBA if the application is runtime or not, so I could test for that and only allow users access if they are using the runtime version I installed.

Thanks again!
Teiwaz
0
 
LVL 41

Expert Comment

by:shanesuebsahakarn
ID: 12172577
Without a doubt, Access 2002. You can test your application by using the /runtime startup command line switch - this makes the full version simulate a runtime environment.
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12172736
we've got A2002 runtime deployed here...and it seems to be coexisting nicely with A97 & A2000

and to emphasize something that shane pointed out...using an installer is important, especially if you are using things like activex controls (date/timepicker etc) and dll's (commdlg etc.)

If you set up your installer script correctly, it will ensure that all the necessary file are included in the package...as well as taking care of registering the ocx's and dll's when necessary. You can also use it to install fonts (app specific such as barcode fonts etc)

I've not used wise or installsheild...but even the basic Package and Deployment wizard that comes with Dev Edition or Visual studio can do a good job...(has in my experience anyways...have heard that some have had problems...)

0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12172816
"way to test in VBA if the application is runtime or not,"

Dim x As Boolean
x = SysCmd(acSysCmdRuntime)
If x = True Then
MsgBox "It's Runtime"
end if

0
 
LVL 41

Expert Comment

by:shanesuebsahakarn
ID: 12172843
> has in my experience anyways...have heard that some have had problems

I think that in a standalone environment, the PDW is ok, it's just when it needs to install on a system that requires coexistance that it can fall over, especially with any OCXs and libraries. I use SageKey+Wise, and it's cut our problems virtually down to nil (at least, so far......!). Admittedly, several of the problems we encountered were when installing on machines with other runtimes on it.
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12173036
Thanks to you all.  I'm going to set the password for now and start looking into runtime 2002 and investigate how to get runtime installed with other versions of Access running.

FYI, I'm using Inno setup (open source setup that has so far worked very well).  I am not using any external tools (oxc, activeX or dll). I am using 3 libraries that I've built (mdbs).  

Thanks again!
Teiwaz
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Microsoft Access is a place to store data within tables and represent this stored data using multiple database objects such as in form of macros, forms, reports, etc. After a MS Access database is created there is need to improve the performance and…
If you need a simple but flexible process for maintaining an audit trail of who created, edited, or deleted data from a table, or multiple tables, and you can do all of your work from within a form, this simple Audit Log will work for you.
Using Microsoft Access, learn some simple rules for how to construct tables in a relational database. Split up all multi-value fields into single values: Split up fields that belong to other things into separate tables: Make sure that all record…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question