Keep secret information in a property ?

  • Thread starter Thread starter Javier via AccessMonster.com
  • Start date Start date
J

Javier via AccessMonster.com

Hi,

I mean an user can create a personal property (CreateProperty) and keep
secret or confidential infomation there better than a secured table ??

How secure is to keep information in a user property DB ??

Which are the advantages and disanvantages ??

thank you !
 
Anyone can read all the properties easily:

(untested)

dim db as database, p as property
set db = dbengine.opendatabase("full path to the database")
for each p in db.properties
debug,print p.name; tab(30);
on error resume next
debug.print p;
if err.number<>0 then debug,print err.description;
on error goto 0
debug.print
next
set db = nothing

So if you need tyo keep the data secret, you'll have to encrypt it
somehow; then you do not cae if someone does read the property - they
will not be able to make sense of it. And if you checksum it, you'll be
able to tell if they have changed it.

HTH,
TC
 
Thanks a lot TC !!

Can you please explain a bit more about: " if you checksum it, you'll be
able to tell if they have changed it."

How to make a checksum ???


I checked your code as follows (becareful I'm Not a programmer)
I think it works better now,........

' ***** START CODE *************
Function funReadProperty()

Dim db As DAO.Database
Dim p As DAO.Property

' ' Set db = DBEngine.OpenDatabase("full path to the database")
Set db = CurrentDb

For Each p In db.Properties
On Error Resume Next

If Err.Number <> 0 Then
Debug.Print "Error-->"; Err.Number; Err.Description
End If

Debug.Print "NAME:--> ["; p.Name; "] VALUE--> ["; p.Value; "] TYPE-->
["; p.Type; "]"

On Error GoTo 0

Next

Set db = Nothing
Set p = Nothing

Debug.Print "THE END...."


End Function
' ********* FINNISH CODE *************

regards,
 
Javier said:
Thanks a lot TC !!

Can you please explain a bit more about: " if you checksum it, you'll be
able to tell if they have changed it."

How to make a checksum ???
Click to expand...

Here's a very simple example. Say you are storing a 6 digit number, eg.
103472. You might define the checksum to be "the lowest digit of the
sum of the digits". The sum of the digits is 17 (1 + 0 + 3 + 4 + 7 +
2), so the checksum would be 7. Append that number to the end of your
number, getting 1034727.

Now say a user finds your number (where it is stored) & changes it to
something else; say 1040727. In your code, when you have retrieved your
number, you would strip off the checksum digit (7), getting 104072.
Then you would recalculate the checksum: 1 + 0 + 4 + 0 + 7 + 2 = 14, so
checksum digit = 4. Oops! This does /not/ match the checksum that came
with the number, so now you know that the user has changed the number
(or the checksum digit).

The method described above is not suitable for a proper checksum. It is
too simple, the user could change the number in various ways /without/
affecting the checksum. But it serves the purpose of example. For
better checksum algorithmys, google for "checksum", "CRC", or "cyclic
redundancy check".

Of course, if the user can get enough of your checksummed numbers, he
can probably work out the checksum algorithm you have used. Then he can
change the number but also calculate a new checksum. Then you don't
know he has changed the number! The solution to that, is to encry[t the
checksummed value; so instead of seeing 1040727 (for example), he sees
#@$%^%! (or whatever).


I checked your code as follows (becareful I'm Not a programmer)
Click to expand...

If you are not a programmer, how can you possibly think to change a
programmer's code? That's like saying, "I'm not an architect, but I've
changed the building plans to look prettier".


I think it works better now,........
Click to expand...

No, it no longer works properly /at all/. You've introduced a number of
faults, see below.

' ***** START CODE *************
Click to expand...
' ' Set db = DBEngine.OpenDatabase("full path to the database")
Set db = CurrentDb
Click to expand...

That change is fine, as long as you understand that my code would print
the properties from /any/ dfatabase, whereas your change will only
print the properties from the /current/ database. My code would print
them from, for example, an external MDE file. Your change could not do
that, because there is no way you can add your code to an MDE file.

For Each p In db.Properties
On Error Resume Next
If Err.Number <> 0 Then
Click to expand...

You've mucked-up the error handling. The way that you have it, the 'If'
statement will /never/ be true, because there is no statement between
it and the preceding 'on error' statement. Also you have deleted (and
therefore missed the purpose of) the semicolons at the end of the first
2 of my 3 debug.print's.

It's good to learn programming. But it's not good to arbitrarily change
someone else's program code, unless you know what you are doing!

Cheers,
TC
 
Um, sorry I jumped on you a bit for changing the code! There's nothing
wrong with changing it to get the output how you want. But you did make
other changes (such as to the error handling) that will stop it working
properly.

Cheers,
TC
 
Back
Top