Is this Ms humour? (1 Viewer)

SmallTime

Registered User.
Local time
Yesterday, 19:29
Joined
Mar 24, 2011
Messages
246
Here's a scenario

I connect to BE SQL server with large tables and to avoid continuous hits to the server and reduce network traffic and most importantly keep the network guys off my back, pull records that are accessed frequently down to temp tables in a locally held access BE (ACCDB) which is encrypted. I read the latest encryption used by Access is a very respectable not so easy to break 256-bit symmetric key. The password is so long and complicated not even I can remember it. in fact I have to write it down and keep it under lock and key in a deep and dark place so no-one can find it. I know all the experts say you shouldn't write passwords down because it defeats the purpose or its a vulnerability, so perhaps maybe someday I would have sprinkled it with Worcester sauce, chewed it up and swallow it never to used again.

Now I can sleep in peace, rested in the knowledge that even the great Edward Snowden can't nick my data and i wont be at the centre or even at the peripheries of a Guardian style report, hounded by former paymasters or mocked by competitors.

Then today I wake up and decide to take a peek in the front end MySysObjects table. Why did I do that when I was already at peace, I'll never know. Was because there's my key in plan text for all to see, written down courtesy of makers of the encryption. Well done guys, nice job.

Why have such a well encrypted file? Is it for therapeutic purposes or just to give me false sense of security and make me 'feel' the data was secure from thievery?

Perhaps I misunderstood the point of encryption and secure passwords? why was I so paranoid about writing it down when I should have in fact plastered it all over the main screen. Someone please tell me I'm just being silly, take me from my dystopia and return me back to my utopia.

Please
 

spikepl

Eledittingent Beliped
Local time
Today, 04:29
Joined
Nov 3, 2010
Messages
6,142
I am sure your comment/question is full of it/wit/bitching/whatever - got lost somewhere half way. If you have a question then ask. If you just want to bitch go elsewhere.
 

SmallTime

Registered User.
Local time
Yesterday, 19:29
Joined
Mar 24, 2011
Messages
246
how do hide the password? - Hope that didn't strain you too much
 

ChrisO

Registered User.
Local time
Today, 12:29
Joined
Apr 30, 2003
Messages
3,202
SmallTime.

If you wish to ask a question then please try to be succinct.
If you wish to rant then please take it to the watercooler.

Chris.
 

ByteMyzer

AWF VIP
Local time
Yesterday, 19:29
Joined
May 3, 2004
Messages
1,409
Hello, spikepl, ChrisO,

SmallTime is raising a legitimate concern. If a User can link to the MySysObjects table in the BE file and obtain the password thereby, then the BE is not truly secure. From the post I gather that SmallTime's inquiry is as to whether there is a way to truly secure this information to keep it from prying eyes.

This strikes me as a genuine inquiry, in spite of the ranting. If there is anyone who can tell whether there is a way to truly secure this information, I'm sure that there are others here who would also be interested to learn it.
 

Galaxiom

Super Moderator
Staff member
Local time
Today, 12:29
Joined
Jan 20, 2009
Messages
12,863
SmallTime is raising a legitimate concern. If a User can link to the MySysObjects table in the BE file and obtain the password thereby, then the BE is not truly secure.

The BE password is stored in MySysObjects table in the Front End. It always has been there. It is also easily found without even opening the Front End in Access because it can be read as plain text directly from the file.

As any expereinced developer should already know, if data needs to be secure then it should be in a database server rather than Access.
 

ByteMyzer

AWF VIP
Local time
Yesterday, 19:29
Joined
May 3, 2004
Messages
1,409
As any expereinced developer should already know, if data needs to be secure then it should be in a database server rather than Access.

Agreed. I find it useful to employ the access file for modelling a database and validating the model from the application, but I always upsize to a more truly secure platform like MS SQL for the BE before I deploy a production solution.
 

shadow9449

Registered User.
Local time
Yesterday, 22:29
Joined
Mar 5, 2004
Messages
1,037
The BE password is stored in MySysObjects table in the Front End. It always has been there. It is also easily found without even opening the Front End in Access because it can be read as plain text directly from the file.

As any expereinced developer should already know, if data needs to be secure then it should be in a database server rather than Access.

I've read this in the past but this leads me to wonder what the benefit of the encryption would be if this is the case. That would be like developing an anti-pick lock but keeping the key in it all the time. Is there some other setup where an encrypted .accde file would be of value?

SHADOW
 

Users who are viewing this thread

Top Bottom