Jeff Atwood's security blunder regarding email

Re:Jeff Atwood's security blunder regarding email by chime on Sunday April 29, 2012 @11:56PM (#3907962)

Emailing yourself password-protected MS Office files isn't much secure either (unless something has changed in 2010 version). I've routinely cracked passwords for my users using freely available tools when they couldn't remember the password to unprotect an Excel workbook.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by nhebb on Monday April 30, 2012 @12:09AM (#3907991)

Which version of Excel were you working with? Security was greatly increased in Office 2007.

http://serverfault.com/questions/122627/how-secure-is-the-en...

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by tedunangst on Monday April 30, 2012 @12:14AM (#3908001)

Were their passwords more complex than "secret"?

There is a known flaw that Office uses (used? I believe it's unfixed) the same RC4 stream for multiple versions of a document, which could be bad news if you used the same password for them and an attacker has old revisions, but even so, that may be hard to leverage if the doc in question is just a list of passwords. [nm, it's been fixed for a while. thanks, nhebb.]

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by yuhong on Monday April 30, 2012 @12:20AM (#3908016)

There was two RC4 keystream reuse flaws in the Office binary formats. One involved salt reuse on save (an implementation bug) and was fixed in Office 2007. But there is still another one that can't be fixed without changing the file format. The original Office 2007 file formats used AES-ECB, but later switched to CBC in SP2.

[ Parent | on HN ]