GLOBALLY CHANGE OLD DOCUMENT PASSWORDS

[LawBrooks]

We need a tool that allows the end user to enter a series of old passwords
and it will search through archived Office Files (Word, Excel, etc.) in
specified directories and its subdirectories and update each matching files
password to a new password. Also provide an option where a file list is
generated for any passwords that dont match.

The usefulness of this tool is as follows:

1. A hacker or trespasser suddenly discovers your document security
password and now can access thousands of sensitive archives. Without the
tool you would be faced with manually opening each file and changing its
password. If an Administrator Level is conducting the change, make sure the
File-Modified Date is NOT updated.

2. Employers who want to ensure former employees cant give out file
passwords to unauthorized persons for future use or if I.T. Security wants to
periodically update the passwords.

----------------
This post is a suggestion for Microsoft, and Microsoft responds to the
suggestions with the most votes. To vote for this suggestion, click the "I
Agree" button in the message pane. If you do not see the button, follow this
link to open the suggestion in the Microsoft Web-based Newsreader and then
click "I Agree" in the message pane.

http://www.microsoft.com/office/com...2792&dg=microsoft.public.office.developer.vba

 

[TC]

No chance. Your suggestion requires that the tool be able to retrieve
the pkaintext password of a previously-passworded docutment. No
properly designed security mechanism will allow you to do this.

Passwords are normally stored by passing them through a so-called
cryptographic one-way hash. This produces an unintelligible number. It
is the number, no the password that is stored. When the user later
enters a password, the security mechanism /does not/ "reverse engineer"
the cryptographic one-way has to see if the entry is correct. Instead,
it hashes the user's entry, and compares that to the value stored in
the file. If the two are the same, the entered password must be
correct.

If you read this carefully you will see that there is /no way/ to
"reverse engineer" the plaintext passwords - /if/ they have been
properly hashed by the relevant security mechanism.

HTH,
TC

 

[LawBrooks]

Perhaps a high-level MACRO could accomplish this instead.

 

[Steve Rindsberg]

No chance. Your suggestion requires that the tool be able to retrieve
the pkaintext password of a previously-passworded docutment. No
properly designed security mechanism will allow you to do this.

Perhaps I misunderstood the original post, but I understood the request to be:

Given the original password(s) for a document or documents, can the process of
opening the document, changing the password and saving the document again be
automated?

If that's indeed the request, that'd be a different problem, no?

 

[TC]

Ok, I hear what you say!

I thought the OP had this in mind:

for each document
get its plaintext password
see if that password is listed
if so, update it to the new one provided

I was right in saying that this should never be possible, in a proper
security scheme. But you are basically pointing out, what should have
been obvious to me in the first place; namely, that the user could:

for each document
for each listed password
try to open the document with that password
if this succeeds, update the password to the new one provided.

In which case he could do what he wanted, using Visual Basic for
Applications (VBA) to implement the method above.

Cheers,
TC

 

[Steve Rindsberg]

Ok, I hear what you say!

Bingo. Eye to Eye.

 

[LawBrooks]

Yes guys thats exactly what Im saying, not retrieving passwords but =trying=
existing known passwords. I brought this suggestion up to Microsoft and
ZDNET like 10 years ago but like <a
href=http://www.quotationspage.com/quote/795.html>Havelock Ellis,</a> no one
paid much attention to my suggestion. Hopefully now someone will and thanks
much to all in advance.