David W. Fenton said:
But if you don't encrypt, you haven't fully secured your data.
Wrong. I've already made my point... Jet encryption does *nothing* to
protect your data as it can be completely reversed independantly of whether
you have applied ULS or not.
Did you even try out the previously mentioned tool on one of your ULS
protected files (and then looked at the file with a Hex editor)?
This is the basis of my whole argument with you here:
Stating that the encryption offers better protection when the encryption is
fundamentally flawed, is wrong. (Note that I'm talking prior to Access 2007
ACCDB file format here, obviously).
If you're trying to protect information from being read, you don't just
want to block access to your data through Jet, but you also want to
prevent someone with a text editor from pulling out data by just
reading in an unencrypted form.
Agreed. But Jet encryption is useless (prior to A2007 ACCDB file format)
for the reasons already explained.
So, yes, you can apply ULS without encryption.
But that doesn't secure your data unless you encrypt it.
But if you encrypt it (even with ULS), then it can be decrypted with ease
(using the tool aforementioned).
So what's the point in doing that? Jet encryption is flawed, so it's next
to useless.
It is better to look at other methods, like Tony has.
No, because the encryption key is stored in the Access executable
because it's the same for all databases.
No it is not. Stop assuming things. The encryption key is stored in the
file header.
The encryption key is randomly generated when you create the MDB file and on
subsequent compact & repairs.
It's a stupid argument since the effect is the same as if the encryption key
had been constant in the EXE ( - but it is not).
Now, with passwords, yes, the encryption key is stored in the
database, because it *has* to be, since it's based on the password.
But for plain Jet encryption, there is no need for storing an
encryption key.
And it's not stored in the MDB.
The encryption key IS stored in the file header. Again stop making
assumptions when you obviously know nothing about what you are talking about.
You are still not understanding that ULS has _no_ effect on Jet encryption.
Jet encryption is a completely independant layer of security and is not
affected AT ALL by ULS.
An encrypted file is not going to protect you if you aren't using
ULS (unless you're only using it to encrypt strings in the code of
an MDE). But if you are, they'll have to crack the ULS (which we all
know is easily done), and then they'll have access to your data with
no additional cracking necessary.
An encrypted file does NOT offer better protection if combined with ULS.
Simple.
Frankly, I'm tired of repeating myself.
We had encryption before we had passwords. Explain how that worked,
then.
As I have said far too many times here... the random encryption key is
stored in the file header (- did you get that?).
Neither database passwords, nor ULS passwords affect the encryption in
anyway. (apart from A2007 ACCDBs database passwords which I've already
explained)
Yes. This is a changed, and a good change for those who find
passwords useful (I find them completely worthless).
Me too. A point I also made in my first post. Worthless in the majority of
cases.
But if you have an MDB and encrypt in A2007 without a password, the
password is not used as the encryption key, because, of course,
there *is* no password.
When I said Access 2007, I meant ACCDB files, not MDB files.
If you use Access 2007 to encrypt an MDB file then it has the same effect as
encrypting it with Access 2003 (i.e. you do not benefit from better
protection).
It is the ACCDB file format that offers the better protection, not the
version of Access used.
And you don't seem to understand some very basic things about Jet,
It is you that does not understand some very basic things about Jet.
As an expert in recovering Access databases, over the years I've documented
the file formats completely.
I know exactly what every single byte of data in a Jet/ACE database is and
does. Can you say the same?
I think that puts me in a better position to comment than your good self.
No offence intended.
which leads me to believe that I should never recommend your
services.
I don't think I'll lose much sleep over that
Wayne Phillips
http://www.everythingaccess.com