File encryption

The quote below is from a parallel thread that I don't want to derail. It says that it is easy to crack open an encrypted Excel file. Is it?

Is it also easy to crack open encrypted files of Word, PowerPoint, other Office apps?

How about pdf files? They have 2 passwords, one is easy to crack, the other one is supposedly much harder to crack.

I thought that as long as the password was 8 characters long with upper cases, lower cases, numbers, special characters, it would take 100 years to crack open the encrypted file, by which time the file contents won't matter any more. Or am I wrong?

How secure is file encryption?

safron said:

Be very careful here! We used to use a very sophisticated Excel workbook (e.g., with hidden worksheets, built-in automated procedures, multiple "tag" columns, password generator) until a friend showed me how easy it was to break the password - it took about 30 seconds. Now we use KeePass, which has superior functionality to what we'd built internally and is much more secure.

Click to expand...

Which version of Office are you using?

Just provide a general discussion, that's what this thread is all about.

Haydon earlier versions of the office suite were not as well secured as today's. So it's relevant but I will unwatch this topic and leave you to it

Strange that people are always expecting specific problems and not expecting insight gathering.

I (and likely others here) knew about early Office (and other early) apps not being good at encryption, but that was long, long time ago. Nowadays, even casual apps like WhatsApp are encrypted.

Nonetheless, how secure are they now? Everything is moving ahead pretty fast, both encryption as well as the tools to crack it.

Usually support forums are for helping with problems. If a solution is offered without a relative question or issue involved and a product name is mentioned the Moderators can take it as advertising.

I think this forum is mostly a support forum indeed but it is also a discussion forum. So, in the latter sense, I tossed up an open issue for discussion.

Back to regular programming, since I mentioned WhatsApp in my last post, I think that one of its raison d'être (and raison d'être of similar apps) is that the service provider can deny responsibility for user-generated content that is flowing on their network, because they cannot know what the encrypted user-generated content is.

Since I mentioned pdf in an earlier post, it has a digital signature feature that a signing computer cannot deny. If encryption is used on top of that with a pre-agreed upon password, it becomes very difficult to deny who the human sender is and vice versa, it becomes very convincing to ascertain who the human sender is. So, here is another use for encryption other than security, i.e. aid for identification.

Edit: I am not trying to annoy anyone I am trying to stimulate the discussion

Quantum computing is eventually going to make Brute Force attacks much more powerful than they are right now so, it's only just a matter of time. Further, Sky ECC was deemed to be the most secure encrypted communications service in the whole world until the protection mechanism was cracked by specialists working at the Belgian police department, and so they managed to intercept close to 61,000 lbs of white powder in the port of Antwerp over the course of a month and a half. That's a lot of insight IMO (and it happened less than 2 years ago).

To encrypt files, I only use VeraCrypt containers or VHDX files encrypted with BitLocker. I don´t trust Office or PDF encryption at all.

If you use an encryption passphrase, your file is only as secure as that passphrase. Not saying that passphrases are not secure but depending on the sensitivity of the file sometimes a pass key is more secure. Whereas instead of needing a password to open the encrypted file , the user would need to provide a pass key to open the file (most of my passkeys are no less than 56 characters in length and without the key the file is useless).
I usually use encrypted files that require pass keys that are stored in the cloud.

If you really want to be paranoid about it , you can encrypt the file and put it inside another encrypted file or any combo thereof , provided you can remember the passphrases or keep track of the passkeys!

Google is ur friend.
Microsoft Office encryption evolution: from Office 97 to Office 2019

garlin said:

Google is ur friend.
Microsoft Office encryption evolution: from Office 97 to Office 2019

Click to expand...

That's the take of a vendor of a password cracking tool. The article does not say so directly, but my reading of it is that an office document from version 2013 and later, encrypted with a computer generated password 8 characters long, is pretty hard to break with 'normal' (commercial type of) resources.

Here is Wikipedia's take
Interesting is the following quote of the above "A July 1, 2021 cybersecurity advisory from British (NCSC) and American (NSA, FBI, CISA) security agencies warned of a GRU brute-force campaign from mid-2019 to the present (July 2021) that focused a "significant amount" of activity on Microsoft Office 365 cloud services." Those are state actors, but maybe us pitiful commercial types can derive inferences from it?