VBA Project Passwords and Security

[jbm222]

I know that encrytion on the passwords for excel sheets and workbooks is pretty weak since that file out there 'password.xla' by Einar Ståle Huse can crack any password in a few minutes (much less for simpler passwords).

I was just wandering if the security you get with password protecting your code is equally weak. I don't know of any programs out there that do this, and generally data leaks are worse in the big scheme of things than having some code get out... but I'm just curious. Considering there are people/companies out there that make some pretty significant money writing VBA code, I would hope the VBA project password encrytion is a little better than that in Excel sheets.

 

[Zack Barresse]

Not really very dependent. VBA passwords can be cracked just as easy. I think I can do it in about 30-45 seconds in about 85-95% of the workbooks I see. Excel is not a secure environment.

 

[litrelord]

Yep, bit of a waste of time by all accounts. Hopefully office 12 will address these issues. Not sure about office 2003 as I haven't tried but there are at least two programs I know of for previous versions that will render project passwords useless. You start the program, tell it where the excel file is, then it opens excel and you can get into the vba project without a password. Of course then you can save the excel file without the project password and bingo, unprotected code.

I'm not sure how much of an effect this actually has in terms of lost revenue though. Most people coding for a living are either employed by a company on a salary in which acse they're losing no money and the company gets what it pays for, or they're working as consultants in which case they're getting a flat fee so the same applies. I guess money could be lost through distibuted add-ins if they had a registration key system like a lot of software does. You'd still need to be able to look through the code to obtain a key though and as far as excel programming goes I'd guess most people who have the ability to do that would rather tackle the project themselves than downloading an add-in and craking it.

Nick

 

[Zack Barresse]

The way I see it, most people don't even know that VBA exists in Office, so the threat is just very, very minimal. And if somebody is scared of somebody getting into their code, they should not be using Excel, but making it a COM add-in or xll file.

 

[gwkenny]

Protecting code

Yeah, the best method that I know of is putting as much of your stuff in DLL's and COM's.

If you want to protect the distribution/number of copies, then you could program in a routine to check the computer's serial ports for a physical serial port key.