Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have heard that security in earlier versions of word was not robust.

With Word 2010, if I use the File > Info > Protect Document > Encrypt with Password option, is this a secure way to protect a file?

Or is it trivial to crack the security provided by this option?

share

migration rejected from stackoverflow.com Jan 23 at 20:37

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as primarily opinion-based by DragonLord, Mokubai Jan 23 at 20:37

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Update: its easy to crack. A couple of my co-workers did it in an hour with some tools –  Ken Shaw Jun 7 '11 at 17:47
    
Ken would you be willing to self-answer your question, mentioning what tools they used? –  nhinkle Oct 28 '11 at 17:04

2 Answers 2

As of Word 2007 (and I am assuming this holds for Word 2010), documents are encrypted with AES-128 by default. With a sufficiently strong password, and barring vulnerabilities, it should not be easily cracked. The ease of cracking the password in your case is likely to be due to the use of a weak password.

Password protection as implemented by older versions of Word uses weak 40-bit encryption by default (though it could be changed), which is one reason the security of the password protection was questionable. Also, vulnerabilities have been found in the Word 2002 and Word 2003 implementations; see http://www.windowsitpro.com/article/office/protection-bypass-vulnerability-in-microsoft-word.

share

I have been asking the same question. As best as I can tell, the previous versions of MS Word (and open for read only protection) had some flaws that allowed people to easily crack passwords. Those same hacks do not seem to work on 2010. (this is only about the password to open the document – I am not talking about the read-only password, which is kind of an oxymoron). Likewise, a search of the internet seems to show that many of the decryption programs do not work on MS Word 2010.

With that said, brute-force methods will always open any file, given enough time. What once took a supercomputer months or years to do can now be done with a home laptop. So today's password might be vulnerable to tomorrow's brute-force power.

Summary: At the moment MS Word 2010 seems sufficient for most business purposes, where you can easily make the password so complex that the brute-force methods would take too long for any reasonable adversary. (P.S. Always assume that people in government agencies will be able to crack any encryption they want to, because they have access to massive computing power)

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.