Password Protection Problems

Subscriber Peter Stutsman wrote last week concerning a problem with opening supposedly protected Word documents in earlier versions of Word, and then losing the protection. Unfortunately, the problem is actually a bit worse than Peter suspected.

Word maintains security passwords with its document files. However, if you load a document and save it in a previous version (in fact, in any word processing format besides the native DOC format of the current Word version), the password protection is stripped from the file. Why? Because Word uses RTF format as an intermediary between DOC and the target format. Since RTF doesn't store the security information, it is lost. (This problem is referenced in Knowledge Base article Q211699.)

Likewise, if someone with an older version of Word installs an import filter that allows them to read later versions of Word documents, the protection is effectively eliminated. For instance, many people with older versions of Word (such as Word 6 or Word 95) have installed an import filter that allows them to load documents created in later versions of Word. When loaded in the older version, some of the features of the later versions of Word are simply ignored. Apparently the security settings are also ignored.

To compound the issue, there are any number of programs available over the Internet that allow Office documents to be accessed without regard to any passwords in place. Sometimes you can even open a "protected" Word document using an import filter on a different word processing program.

The bottom line--Word's security is nowhere near secure, and sometimes not even a deterrent. Your typical run-of-the-mill power user can probably bypass the security measures with only minor inconveniences. How can someone get around this problem? Unfortunately, you can't get around it by relying simply on Microsoft. If you need to protect a document, you need to rely on a third-party tool, such as the PGP (Pretty Good Privacy) encryption and decryption tool.