Openoffice Security Issue

[Ahamed Fasudeen]

Hi Team,

I'm newly use openoffice...I have some query realted for password security.

Currently i'm using MSoffice2003. In that i have protect the sheet & workbook

And i have protect the cell A2:C22(attached sheet) with password range,in msoffice2003 once i click
the A2:C22(cell) it will pop-up password box once i give the password it will allow to enter
the data. And in D2:D22 with out range password user will edit without password.

When i use to open the msoffice speared  sheet to openoffice... entire restriction was removed by calc(openoffice)

i don't why it was happen....with less security in open office.

Could you please provide me the fix for this issue....

--
Regards,
Ahamed
9740843336


---------------------------------------------------------------------
To unsubscribe, e-mail: discuss-unsubscribe@...
For additional commands, e-mail: discuss-help@...

[Bruce Martin-4]

Dear Ahmed:

 

Any open office file can be protected in a number of ways.

 

1)    The entire file can be saved with a password, provided it is saved in
the appropriate Open office native format.

 

2)    Spreadsheets in Calc can also be protected, with selective control; of
what cells are protected and which are not. For each cell, you can have it
either:

 

a.    Unprotected

 

b.    Protected, with formula visible

 

c.     Protected with formula also hidden.

 

Today I have to go out of town, but later I will try and get a moment to
look at your example and see what is what.

 

By the way, what time zone are you in? (if not sure, what country?

 

Best regards,

 

Bruce Martin

Quebec, Canada

Brucemartin10@...

[Malte Timmermann]

Hi Ahmed and Bruce,

thanks for looking at this - I must admit that I am not very familiar
with the different cell/sheet protection features in Calc.

I just wanted to point that this is _not_ a security issue, and even not
a privacy issue.

Cell protection is a pure UI feature. The content is not encrypted in
the document (except for password protected documents).

So this issue might end up in a missing feature in Calc (cell protection
doesn't work w/o sheet protection), or in a bug that the xls import
filter doesn't recognize this feature.

Malte / OOo Security Team.

Bruce Martin wrote, On 10/30/09 13:42:

> Dear Ahmed:
>
>  
>
> Any open office file can be protected in a number of ways.
>
>  
>
> 1)    The entire file can be saved with a password, provided it is saved in
> the appropriate Open office native format.
>
>  
>
> 2)    Spreadsheets in Calc can also be protected, with selective control; of
> what cells are protected and which are not. For each cell, you can have it
> either:
>
>  
>
> a.    Unprotected
>
>  
>
> b.    Protected, with formula visible
>
>  
>
> c.     Protected with formula also hidden.
>
>  
>
> Today I have to go out of town, but later I will try and get a moment to
> look at your example and see what is what.
>
>  
>
> By the way, what time zone are you in? (if not sure, what country?
>
>  
>
> Best regards,
>
>  
>
> Bruce Martin
>
> Quebec, Canada
>
> Brucemartin10@...
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: discuss-unsubscribe@...
For additional commands, e-mail: discuss-help@...

[Bruce Martin-4]

Good Morning Malte:

It is possible in that case that Oo needs to automatically encrypt Calc
sheets where sheet protection is activated, but not necessarily require a
password to open the file unless the file is saved with one.

This would seem to me to mean the need for a "front end" layer to the
encryption module that would handle the operation of the encryption
appropriately for all cases.

Hence, if a user were to protect one or more sheets, the whole workbook
would automatically be encrypted, but, when saved would not necessarily
force the use of a password at the file level.

When it was reopened, (assuming it was not saved with a file level password)
it would then decrypt on the fly only the unprotected areas. If the user
then needed to unlock one or more sheets, those sheets would be decrypted on
the fly when they were unprotected. If they were subsequently re-protected,
they would re-encrypt on the fly.

I would think that both this "front end" and the encryption itself should be
fully compiled as one section, and, if possible itself encrypted to
discourage hacking of itself. This should render Oo to be viable in places
where significant money is involved, and where there is that kind of money,
there should be money in the woodwork to better support Oo and java
development.

I think, unpleasant as the thought may be, that in present times where the
economy is not doing well, and there may be a higher general propensity of
various individuals to gain their money in wrongful ways, such as hacking
and misappropriation in many places, «Vaut mieux prévenir que guérir!» ("A
stitch in time saves 9.")

Cheers, all

Bruce Martin


---------------------------------------------------------------------
To unsubscribe, e-mail: discuss-unsubscribe@...
For additional commands, e-mail: discuss-help@...

[Graham Lauder-2]

On Thursday 29 October 2009 14:32:52 Ahamed Fasudeen wrote:

> Hi Team,
>
> I'm newly use openoffice...I have some query realted for password security.
>
> Currently i'm using MSoffice2003. In that i have protect the sheet &
> workbook
>
> And i have protect the cell A2:C22(attached sheet) with password range,in
> msoffice2003 once i click
> the A2:C22(cell) it will pop-up password box once i give the password it
> will allow to enter
> the data. And in D2:D22 with out range password user will edit without
> password.
>
> When i use to open the msoffice speared  sheet to openoffice... entire
> restriction was removed by calc(openoffice)
>
> i don't why it was happen....with less security in open office.
>
> Could you please provide me the fix for this issue....

Why is this an OOo security issue that OOo has to fix.  If the Excel password
is so easily ignored, then it's an Excel security problem, because Excel
purports to password protect that cell.
This is obviously not the case, if OOo can simply ignore it.  That's an Excel
problem, not OOo's.  
Get Microsoft to fix the Excel security bug that allows security to be easily
overridden.  

Of course some people have found this particular thing quite useful when they
forget the passwords they put in their Excel spreadsheets.  :)

Cheers
GL
--
Graham Lauder,
OpenOffice.org MarCon (Marketing Contact) NZ
http://marketing.openoffice.org/contacts.html

INGOTs Moderator New Zealand
www.theingots.org.nz


---------------------------------------------------------------------
To unsubscribe, e-mail: discuss-unsubscribe@...
For additional commands, e-mail: discuss-help@...

[Daniel Rentz]

Hello,

Malte Timmermann schrieb:

> Cell protection is a pure UI feature. The content is not encrypted in
> the document (except for password protected documents).
>
> So this issue might end up in a missing feature in Calc (cell protection
> doesn't work w/o sheet protection), or in a bug that the xls import
> filter doesn't recognize this feature.

Cell protection depending on sheet protection is intended. This
behaviour is equal in Calc and Excel.

Regards
Daniel

---------------------------------------------------------------------
To unsubscribe, e-mail: discuss-unsubscribe@...
For additional commands, e-mail: discuss-help@...

[Malte Timmermann]

Hi Bruce,

short answer - encryption only makes sense when the key is provided from
the user, or some other source, like a private key certificate.

It is not possible for OOo to encrypt anything on it's own w/o using a
static hard coded password, or using a random password and store it in
the document. So in one situation you can find it in the source, in the
other situation you can find it in the document.

Malte.

Bruce Martin wrote, On 10/30/09 14:29:

> Good Morning Malte:
>
> It is possible in that case that Oo needs to automatically encrypt Calc
> sheets where sheet protection is activated, but not necessarily require a
> password to open the file unless the file is saved with one.
>
> This would seem to me to mean the need for a "front end" layer to the
> encryption module that would handle the operation of the encryption
> appropriately for all cases.
>
> Hence, if a user were to protect one or more sheets, the whole workbook
> would automatically be encrypted, but, when saved would not necessarily
> force the use of a password at the file level.
>
> When it was reopened, (assuming it was not saved with a file level password)
> it would then decrypt on the fly only the unprotected areas. If the user
> then needed to unlock one or more sheets, those sheets would be decrypted on
> the fly when they were unprotected. If they were subsequently re-protected,
> they would re-encrypt on the fly.
>
> I would think that both this "front end" and the encryption itself should be
> fully compiled as one section, and, if possible itself encrypted to
> discourage hacking of itself. This should render Oo to be viable in places
> where significant money is involved, and where there is that kind of money,
> there should be money in the woodwork to better support Oo and java
> development.
>
> I think, unpleasant as the thought may be, that in present times where the
> economy is not doing well, and there may be a higher general propensity of
> various individuals to gain their money in wrongful ways, such as hacking
> and misappropriation in many places, «Vaut mieux prévenir que guérir!» ("A
> stitch in time saves 9.")
>
> Cheers, all
>
> Bruce Martin
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: discuss-unsubscribe@...
> For additional commands, e-mail: discuss-help@...
>

---------------------------------------------------------------------
To unsubscribe, e-mail: discuss-unsubscribe@...
For additional commands, e-mail: discuss-help@...