Encrypting a password stored in a module (1 Viewer)

[JamesMcS]

Afternoon all! Hope the weekend was fun....

So - I've just written a nice little module to relink some tables in a front end, depending on where the user has decided to install the application. In the module, before I append the new tabledef, I've got a string specifying the connect string - with the password written in for all to see.

Any ideas how I hide that from people? A variable, I would imagine, but how do you hide that from the great unwashed? (Not including MDEs, restricting access to modules etc.)

 

[gemma-the-husky]

XOR is your friend here.

get an array of numbers under 255

then xor each character in the string to be encrypted, with the corresponding item in the array.

so pseudocode (hope this makes sense)

for each char in string
  char = char xor array(charpos)
next

naturally it's a bit harder in vba, as there is no char as such

the nice thing about xor, is that if you repeat the operation on the encrypted string, you get the original string back.

definitely hard to crack for a short string.

 

[JamesMcS]

Cheers Dave, that sound like the way to do it - but it seems to me that with any method, the original string is going to be in plaintext, somewhere... can you encrypt or PW protect a module?

Edit: I realise I said not including the above - in the original I meant to say "stop people from viewing the VB editor". Idiot

 

[DJkarl]

Well even if you encrypt it at some point you would need to decrypt it as Access can only deal with the plain text password in the connection string. If the password is stored somewhere in code you could have a decryption routine and only store the encrypted password text in the program...of course if you have the decryption process as part of the database it makes getting the password pretty easy. Locking down the code helps mitigate this, but it is still relatively easy to retrieve. There isn't really a great method for this, the best you can hope for is to discourage casual users, a determined user or developer will be able to retrieve the password if desired.

 

[JamesMcS]

Seems the only way to do this is to lock the project for viewing under VB Editor Tools>Properties>Protection

Cheers for the input gang!

 

[gemma-the-husky]

no the original string isn't stored in plain text

you enter the original string - if you want to hide it, use a password input mask - but before you save it you encrypt it

[storedfield] = encrypt([plaintextfield])

all the user sees in the stored table is a string of garbage characters


when you need to get the plaintext back you just say

[plaintext] = encrypt([storedfield]

but that's all handled in your code.

 

[Galaxiom]

Seems the only way to do this is to lock the project for viewing under VB Editor Tools>Properties>Protection

Be aware that in a password protected project and even in a compiled project, the strings are still stored in plain text so an unencrypted password remains visible by simply opening the file in a text editor.

It isn't hard to write a script to extract the likely password candidates and try them, so some form of encryption is essential.

 

[JamesMcS]

Cool OK thanks everybody!

 

[gemma-the-husky]

James

all this is still based on providing an mde. you don't want people ot see how you are controlling the security.

 

[JamesMcS]

Yeah I'm experimenting with MDEs at the moment - they don't seem to like accessing linked tables over our network for some reason.... I think it's to do with the size of the dataset so my next job is to build smaller tables for each user and get the speed back up a bit...