Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have heard that security in earlier versions of word was not robust.

With Word 2010, if I use the File > Info > Protect Document > Encrypt with Password option, is this a secure way to protect a file?

Or is it trivial to crack the security provided by this option?

share|improve this question

migrated from stackoverflow.com Oct 28 '11 at 13:41

This question came from our site for professional and enthusiast programmers.

2  
Update: its easy to crack. A couple of my co-workers did it in an hour with some tools –  Ken Shaw Jun 7 '11 at 17:47
    
Ken would you be willing to self-answer your question, mentioning what tools they used? –  nhinkle Oct 28 '11 at 17:04

2 Answers 2

As of Word 2007 (and I am assuming this holds for Word 2010), documents are encrypted with AES-128 by default. With a sufficiently strong password, and barring vulnerabilities, it should not be easily cracked. The ease of cracking the password in your case is likely to be due to the use of a weak password.

Password protection as implemented by older versions of Word uses weak 40-bit encryption by default (though it could be changed), which is one reason the security of the password protection was questionable. Also, vulnerabilities have been found in the Word 2002 and Word 2003 implementations; see http://www.windowsitpro.com/article/office/protection-bypass-vulnerability-in-microsoft-word.

share|improve this answer

I have been asking the same question. As best as I can tell, the previous versions of MS Word (and open for read only protection) had some flaws that allowed people to easily crack passwords. Those same hacks do not seem to work on 2010. (this is only about the password to open the document – I am not talking about the read-only password, which is kind of an oxymoron). Likewise, a search of the internet seems to show that many of the decryption programs do not work on MS Word 2010.

With that said, brute-force methods will always open any file, given enough time. What once took a supercomputer months or years to do can now be done with a home laptop. So today's password might be vulnerable to tomorrow's brute-force power.

Summary: At the moment MS Word 2010 seems sufficient for most business purposes, where you can easily make the password so complex that the brute-force methods would take too long for any reasonable adversary. (P.S. Always assume that people in government agencies will be able to crack any encryption they want to, because they have access to massive computing power)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.