Changing a query Dynamically

[Galaxiom]

It is worth mentioning that, though otherwise more secure, adding a digital signature to an ACCDB/ACCDE file has absolutely no effect. To repeat, it does nothing.
See this article by AWF member sonic8: https://codekabinett.com/rdumps.php?Lang=2&targetDoc=signing-vba-code-access-accdb

That article only mentions signing the accdc package. As far as I am aware, there is no way to usefully sign an accde file.

Of course any file can be signed but that is only useful if the application or operating system can be instructed how to react to the signature. Our network admin once experimented turning a Group Policy that prevented unsigned exe files from running. I signed one myself before he abandoned the policy as more trouble than it was worth.

Similarly I could sign an accde but Access probably wouldn't care if the signature was valid or not, if indeed adding the signature didn't stop it working altogether. Then just running the file would cause it to change and invalidate the signature because it applies to the whole file rather than particular sections as happens with signed Office files.

Signed packages and Trusted Locations look like a Claytons security model to me. My understanding is that the signature on a package just allows it to be extracted into a Trusted Location without a warning.

A user can still copy arbitrary files into a Trusted Location where Office will assume they are fine. Unfortunately users need to have write access to the folder to create the lock file when they run the Access file. Otherwise they will probably, at best, get a read only warning.

Which brings me back to where I started with signatures. My primary goal back in the days of Access 2003 was to avoid the startup warning. I wasn't actually that concerned about security per se.

 

[isladogs]

Thanks Greg

I no longer sign Access files myself but hopefully Phillip Stiefel (sonic8) will see and possibly respond to this thread

 

[sonic8]

That article only mentions signing the accdc package. As far as I am aware, there is no way to usefully sign an accde file.

Well, the article describes what you end up with when following the documentation on "Signing your database". - And, yes, that is effectively creating and signing an AccDC package.

Beyond that, I agree with your assessment of the current options for signing Access files and do not have anything to add. :-/

 

[The_Doc_Man]

adding a digital signature to an ACCDB/ACCDE file has absolutely no effect.

This is in fact a basic security concept. One of the reasons that .MDx and .ACCDx files are less than perfectly secure is that the putative hacker doesn't play by the rules.

It has long been known that when you lock something, you do so by using a particular type of system call. Hackers, because they use backdoors and such, never go through the system routine that would normally check for locks. If your hacker had a way to determine a physical block address on a disk and had physical I/O capability (which is one of the things hackers commonly get), THERE ARE NO LOCKS.

Therefore, when someone puts a digital signature on something, that only tells the FILE system that a signature exists. In this case, Access doesn't care so doesn't honor the implications of the signature or test the file for tampering.

It is important, therefore, to realize that methods used to secure a database only work for those people who play by the rules. For people to whom rules are at best speed bumps along the road, they will drive in that Mack truck and abscond with all your data pretty much at leisure. Which is why encryption and other obscuration methods are so important if you have critical data.

 

[Galaxiom]

Signatures were never intended to secure the data. Their purpose is solely to validate that the file has not been tampered with since having an authorised signature applied.

They are used in conjunction with system settings that prevent the running of unsigned applications or applications where the signature does not match the content, depending on the settings.

In the case of Office documents it prevents users inadvertently opening files that may contain malicious macros.