How secure is an Excel password protected file?

RG2015

There is a thread on the banking board discussing password protected Excel files with an ongoing difference of opinion.

So my question is, how easy is it to access a password protected Excel file without knowing the password?

I have Excel 2016 so I am not too concerned with earlier releases which I understand are less well encrypted. The thread started out questioning the security of Google Drive but strayed a bit at post #10 to the Excel issue.

https://forums.moneysavingexpert.com/discussion/5761920

Neil_Jones

Excel 2016 uses the same type of encryption technology as a lot of Ransomware does, which makes it fairly secure if your password is long and complex enough (ideally 32+ characters and some special characters - brackets, ampersands, etc) - Brute force and dictionary attacks are always possible. Of course remember your password!

John_Gray

You could get an idea how secure are the documents and spreadsheets in versions of Office since about 2003 by searching for password crackers for these.

Good luck in finding any...

Debbie_Savard

Choose a three-word pass-phrase like GreekSucceedCook and input it using the on-screen keyboard to defeat keyloggers.

AndyPix

John_Gray wrote: »

You could get an idea how secure are the documents and spreadsheets in versions of Office since about 2003 by searching for password crackers for these.

Good luck in finding any...

Before 2013 they were very insecure ..


But even now, Dont be too sure that your IT dept cant crack your document


https://blogs.technet.microsoft.com/office_resource_kit/2013/01/23/now-you-can-reset-or-remove-a-password-from-a-word-excel-or-powerpoint-filewith-office-2013/

onomatopoeia99

AndyPix wrote: »

But even now, Dont be too sure that your IT dept cant crack your document

One would expect IT to have access to password protected company documents without the password.

If an employee gets run over by a bus, their password protected company documents should not become completely inaccessible to the company.

This does have the downside (depending on your point of view) that if people sneakily do personal stuff at work using the company copy of Office, IT can see their protected documents.

[Deleted User]

Debbie_Savard wrote: »

Choose a three-word pass-phrase like GreekSucceedCook and input it using the on-screen keyboard to defeat keyloggers.

You should really insert some special characters into these too

JohnB47

I remember last year receiving a spreadsheet as an aid to working out a financial proposition. I was curious as to how some of the calculations were made, so I Googled to see if I could break into it. It was very easy.

I can't remember the detail now but it involved doing something to the original then applying a password - perhaps it was the original password or maybe a new one. Took me about 15 minutes in total and worked perfectly.

Let's face it, everything can be broken into - it's only a matter of time, effort and perceived reward.

googler

Open an Excel spreadsheet with Notepad or a similar text editor, and you can see loads of content, probably every text and number field at least..

Note sure how easy it would be to use it, that would depend on the sheet, and how 'keen' the opener was....

Debbie_Savard

>You should really insert some special characters into these too<

Doesn't increase the entropy of a 3-word pass-phase by any meaningful amount and increases tendency to write the passphrase down.

Heedtheadvice

Having used those files for years I would support the view that the passwords are fine for protecting work from inadvertent modification.
I would not recommend to secure personal or financial details or important confidential or copyright work that is held within the public domain!

In between, maybe after a risk assessment.....