Solved

How secure is Access VBA Project Password?

Posted on 2004-09-27
15
849 Views
Last Modified: 2010-05-18
I need to know how securely the VBA project password is stored within Access.  Is it encrypted within the MDB?  How strong is any encryption? What differences are there in how this is done in various Access versions (A2K, Access XP, Access 2003)?  How easy is it to crack?  I'm planning on using a 16 character random alpha-numeric password.

My preference would be to use MDE, but we are having a bear of a time with Access XP versions, e.g. an MDE compiled on one version of Access XP will cause another version of Access XP to crash when the app is opened.  Until we get that figured out, I need to secure the code (thus understand how well the VBA Project Password works).

Thanks!
Teiwaz
0
Comment
Question by:teiwaz
  • 7
  • 3
  • 3
  • +2
15 Comments
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165437
Secure ?  nope

From Google...

Web  Results 1 - 10 of about 103,000 for access project password crack. (0.18 seconds)  

better than nothing however...
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165445
oh ...afaik...the length/complexity  of the pwd is irrelevant to someone with the crack tool...it apparently bypasses the pwd altogether...another hidden "feature" of access
0
 
LVL 77

Expert Comment

by:peter57r
ID: 12165450
Hello teiwaz,

The password is totally secure against users for whom access to the code would be of little or no interest.
It is totally insecure against users for whom access to the code would be worthwhile.
The same is true for all Access security.


Pete
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165462
a recommendation to deal with the real problem of not being able to use an mde

get a developers edition of access and distribute the access runtime app to all users. This assumes that users have no need to edit or create anything....mde + runtime = nothing to look at and nothing to look at it with. plus the homongeneity of the app will eliminate the problem
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12165465
probably should say...

app will HELP eliminate the problem

(runtime has it's own quirks as well)
0
 
LVL 8

Expert Comment

by:Benjamin_Luk
ID: 12165824
The best way should be : MDE, only this can do the safety security for code.

Best Regards

ben
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12165833
So what you are saying is that the password or its storage method is completely irrelevant, because Access provides an alternate way to get in, completely bypassing it?  Great!

On the runtime version, what issues will i run into distributing this when virtually all of my users have Access (full version) already installed?

Thanks!
Teiwaz
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 36

Accepted Solution

by:
SidFishes earned 300 total points
ID: 12166197
well..it's not completely irrelevant...but it depends on the situation. If this is an in house application, you're "probably" reasonably safe...for most users...simply entering their OWN pwd is a chore ....and anyone caught dl'ing a crack app on my network would be immediately canned...and would assume your co has a similar policy...that's enough to keep most other users inline...If it's a distributed app..i wouldn't rely on it for a second..

runtime _can_ coexist with full versions but it also might be worse than where you are now...

you might want to open a new q? and get some help diagnosing the root of the problem...i suspect reference issues...



 
0
 
LVL 41

Assisted Solution

by:shanesuebsahakarn
shanesuebsahakarn earned 200 total points
ID: 12166637
I would suggest looking into SageKey for Wise/InstallShield (www.sagekey.com) if you want to use the runtime - this makes coexistance much easier. Of course, that doesn't solve your problem - if the user also has a full version, they can just open your mdb file from their full version of Access.

I agree with Sid about references. You should check that all required OCX and DLL files exist on the target machines, with the correct versions. MS controls are particularly bad in this regard.
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12172532
OK, one last follow up question, and then I'll close this down and open one on the reference issues.

My users are using either Win2k or XP for their OS and either Office 2k or Office XP. Currently I am developing in Access 2k.  If I were to go with the runtime solution, which is more stable/fewer bugs/plays best with other installed versions of Access: Access 2k or Access 2002(XP)?

And one comment, I think there is a way to test in VBA if the application is runtime or not, so I could test for that and only allow users access if they are using the runtime version I installed.

Thanks again!
Teiwaz
0
 
LVL 41

Expert Comment

by:shanesuebsahakarn
ID: 12172577
Without a doubt, Access 2002. You can test your application by using the /runtime startup command line switch - this makes the full version simulate a runtime environment.
0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12172736
we've got A2002 runtime deployed here...and it seems to be coexisting nicely with A97 & A2000

and to emphasize something that shane pointed out...using an installer is important, especially if you are using things like activex controls (date/timepicker etc) and dll's (commdlg etc.)

If you set up your installer script correctly, it will ensure that all the necessary file are included in the package...as well as taking care of registering the ocx's and dll's when necessary. You can also use it to install fonts (app specific such as barcode fonts etc)

I've not used wise or installsheild...but even the basic Package and Deployment wizard that comes with Dev Edition or Visual studio can do a good job...(has in my experience anyways...have heard that some have had problems...)

0
 
LVL 36

Expert Comment

by:SidFishes
ID: 12172816
"way to test in VBA if the application is runtime or not,"

Dim x As Boolean
x = SysCmd(acSysCmdRuntime)
If x = True Then
MsgBox "It's Runtime"
end if

0
 
LVL 41

Expert Comment

by:shanesuebsahakarn
ID: 12172843
> has in my experience anyways...have heard that some have had problems

I think that in a standalone environment, the PDW is ok, it's just when it needs to install on a system that requires coexistance that it can fall over, especially with any OCXs and libraries. I use SageKey+Wise, and it's cut our problems virtually down to nil (at least, so far......!). Admittedly, several of the problems we encountered were when installing on machines with other runtimes on it.
0
 
LVL 1

Author Comment

by:teiwaz
ID: 12173036
Thanks to you all.  I'm going to set the password for now and start looking into runtime 2002 and investigate how to get runtime installed with other versions of Access running.

FYI, I'm using Inno setup (open source setup that has so far worked very well).  I am not using any external tools (oxc, activeX or dll). I am using 3 libraries that I've built (mdbs).  

Thanks again!
Teiwaz
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Suggested Solutions

QuickBooks® has a great invoice interface that we were happy with for a while but that changed in 2001 through no fault of Intuit®. Our industry's unit names are dictated by RUS: the Rural Utilities Services division of USDA. Contracts contain un…
A simple tool to export all objects of two Access files as text and compare it with Meld, a free diff tool.
Basics of query design. Shows you how to construct a simple query by adding tables, perform joins, defining output columns, perform sorting, and apply criteria.
In Microsoft Access, learn how to use Dlookup and other domain aggregate functions and one method of specifying a string value within a string. Specify the first argument, which is the expression to be returned: Specify the second argument, which …

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now