No longer prompting for password?!?!?

[AnOOOuser]

My protected OOO files no longer request a password. They are still shown as protected (as indicated by the "unprotect" button on the Properties dialog).

Unprotecting and re-protecting it, and shutting down OOO and restarting it, does not correct the behavior.

My encrypted files suddenly have zero protection. It started after an occasion when I attempted to hibernate my computer and it refused to complete hibernation. After forced-shutdown, during OOO recovery, it recovered the file and opened it without asking for a password.

I can't seem to protect the file at all now.

[Villeroy]

It is a restored document. The auto-save mechanism stores your loaded documents without encryption, otherwise they would not be restorable.
Save it again with the pasword.
menu:File>Save As...
enter the same name to overwrite the existing file.
Check the password option

[AnOOOuser]

@Villeroy I thank you for your reply but feel the need to correct you. It has always asked for a password during recovery. This is the first time, ever, that it has failed to do so; and the first time, ever, that the password protection has been stripped from the file during recovery.

I do this procedure many times per week, in the world's simplest office environment, so the irregularity cannot be mistaken. This is the first time it has failed to leave the password intact on the recovered document, after thousands of times doing so.

I'm hoping this clarification jogs someone's memory about a situation that matches mine more exactly.

[Villeroy]

You have an ODF document (odt, ods, odp, odg).
Once upon a time you saved it with a password protected encryption which requires that you enter the correct password before the document appears on screen.
Due to some glitch, the document got corrupted but could be restored from the unencrypted automatic backup copy. Now it opens like an ordinary unprotected document without prompting for a password.
And now you can not save the document with a password? Why not?

[AnOOOuser]

Almost correct.

You have an ODF document (odt, ods, odp, odg).

Yes; OOo spreadsheet.

Once upon a time you saved it with a password protected encryption which requires that you enter the correct password before the document appears on screen.

Yep. This file is essential for daily activities, so it is one of the first things I open every time the computer is started.

Due to some glitch, the document got corrupted but could be restored from the unencrypted automatic backup copy. Now it opens like an ordinary unprotected document without prompting for a password.

Yes. Document was open when I triggered the computer to hibernate. Document was not widely corrupted, the data seems fine; OOo was merely one of the open documents when the computer failed to finish entering hibernation. All my documents recovered perfectly fine (as usual), except for the password issue on this document.

The cause in this case, happens once or twice a month -- a freeze during hibernate with this file open. The outcome however has never happened before: the loss of the password functionality on the file.

And now you can not save the document with a password? Why not?

I was able to Save As... to create a new password. My concern is forensics. I want to know why:

1. Why the document lost its encryption/password protection under a situation where this had never happened before
2. Why unprotecting and re-protecting the document did nothing
3. Why I should trust this security mechanism if it is going to simply fall off the file without reason

[Villeroy]

3. You mentioned the reason.
2. ???
1. The developers hang out on their mailing list. I guess that it depends if the document content needs to be restored or the document archive.

[AnOOOuser]

3. You mentioned the reason.
2. ???
1. The developers hang out on their mailing list. I guess that it depends if the document content needs to be restored or the document archive.

Great, let me know if you feel like being less glib, less dismissive, or much more clear so that what you are saying does not come off as totally glib and dismissive.

[Villeroy]

OK, I'm ready. What was your question?

[AnOOOuser]

1. Why the document lost its encryption/password protection under a situation where this had never happened before
2. Why unprotecting and re-protecting the document did nothing
3. Why I should trust this security mechanism if it is going to simply fall off the file without reason

[Thumbs]

I just experienced the same loss of password protection. In my case, the file has been protected for at least a year and that protection has survived countless file recovery operations. Today, the file opened without requesting a password...

[RoryOF]

Then try a new Save As and select to Password. Until a problem such as loss of password protection can be recreated by the developers, no effort will be expended on it, as the problem may be a chimera.

However, as OO passwords are effectively unbreakable, I never recommend passwording.

[AnOOOuser]

> no effort will be expended on it

Making the existence of this feature like a sinkhole for building your house on.

And this community like a band of land speculators in sale-phase who would say "oh yeah, that's ... TOTALLY ... solid"

"Unbreakable" huh. Pretty brazen. IT BREAKS ALL THE TIME NOW. Thank goodness for Libreoffice, Calligra, and other options generally.

I'll tell you what else... I'm an anti-imperialist activist who wants my country held accountable for war crimes and am generally an intellectual agitator. _And my passwords have been compromised, and this community is being f'king cute about it._ What the hell part of the open source tradition are you from? This is my first massively bad experience with the Apache community in the 18 years I've been a FLOSS user. That feeling you are having right now, whether you enjoy it or not -- it is the feeling of being capitally useless at the worst time.

[RoryOF]

The code is downloadable. You want it fixed, you fix it. I have other things to do than fix problems happening on YOUR computer driven by YOU.

[Thumbs]

My concern is simply that some sort of malware/virus/whatever may be in the wild causing problems...
"Was there ever any sign, any strange event, which could have been a sign of an infection?"
"Well, my password protected document once spontaneously lost the password protection."

Possible responses:
1) "Oh, that's nothing. It's okay if password protection can be turned off. Nothing is really secure anyway."
2) "Oh, that's bad. Password protection should prevent any unwanted document access. We (collectively, particularly those with the appropriate knowledge) need to address this!"

My belief is that answer number 2 is the correct response. I continue to act as if nothing is really secure but prefer to take reasonable actions. Perhaps running antivirus/system protection software through a traffic-limiting hardware device is no longer sufficiently "reasonable" for a home user? BTW- this is not the time nor forum for that discussion.

[Villeroy]

I have answered this already. If there was some kind of crash and your document was recovered on next start it may be recovered unencrypted.
If you are paranoid about security, install Linux and cool down.

[Thumbs]

Thanks, but no thanks. A wave-of-the-hand dismissal is not a solution. If the security of password protection can be removed through a crash and recovery process than there is a problem with the security of the password protection scheme. I am not seeking comfort by posting here, merely letting the community at large know that there is a problem. How the community responds is beyond my control. My hope is that someone will accept that there is an issue and will fix the problem.

[RoryOF]

If you are concerned about the stability of the passwording, then as a workaround I suggest you store your files in an archive using a password. This will necessitate the extra step of packing and unpacking the archive; you may also need to remove any temporary and backup files to maintain your file security.

Edit: Note that we can only recommend solutions or workarounds when we know them. The exact configuration of the code and the rewriting of it to bring about long-term solution of problems is not our day to day priority, as we are not developers.

[Thumbs]

Thanks for the suggested work-around. I'm going to go with the hope that it was truly a very rare glitch and not hacking. If others report the same problem with increasing frequency then the developers will have some history to work on.

[floris v]

See 22 pages term paper replaced with pound signs. That issue has caused more damage than a loss of password protection. But as fas as I know the developers haven't done anything about it. If you can't offer the developers something tangible to work on, they simply won't even start investigating this. And I'm very sure that you aren't going to send them your password protected file. Your best bet is to make sure that unauthorized people can't even access your computer.

[Thumbs]

I was going to say, "You get what you pay for..." But I actually donate for my copies, at about half the price of M. Office, I did that for our office computers as well. I know it doesn't change things for this issue though at least I don't have to feel guilt.

Cheers!

[floris v]

Remember the hype about Windows XP - how it was going to be stable, secure, etc, and how many security fixes you had to download afterwards? And that was paid software.

[saintgeo]

Hi,
Just to mention that I have the same problem.
I opened a new spreadsheet, copied and pasted the content from the previous to the new spreadsheet, protected the new one with a password, saved, closed.
When I re-open it it does not prompt me for the password...
I uninstalled 4.1.3 and downloaded 4.1.5. Same problem.
I am puzzled... Anyone had the same problem lately?
Is it possible that windows remembers the password and feeds it to OO? I have to try to open the file with another computer.
Thanks,
Eric,

[mjlcourier]

I also experience this several times per year. I access an .odt document regularly as a personal journal from different devices. The file is stored in Dropbox. I have several times found the file opening without prompting for a password unexpectedly. This raises questions with me as to the effectiveness of the encryption. How do I tell when the encryption will next fail leaving the contents of my personal journal flapping in the breeze? The best hypothesis I have is that OpenOffice gets confused sometimes if I open an instance of my file on one device without having closed it on another, which is rare but does happen, and causes a new file named 'conflicted copy from x device' to be saved alongside the true copy. In these cases I manually merge the conflicted contents. But is there a correlation between these events? I can't really tell as they have more than once happened without any temporal conjunction. I would really like to know what triggers the encryption on an .odt file to suddenly switch off like this.

[RoryOF]

As a quick guess, the file opening without a password request may indicate that the passwording is applied after the entire archive that is an OpenOffice file is created. The OpenOffice file is an archive composed of several files; these are placed in position, an area allocated for the content file which can be initialised to a placeholder, then filled with the actual content; the archive is then closed. I suspect at this stage the passwording is applied.

It is possible (this is a guess on my part) that you have powered down the computer without allowing the few seconds for this operation to occur and thereby broken the connection to Dropbox before the passworded file is written. Such over-hasty close down of a computer can lead to more serious errors than loss of passwording, such as damaged files, often irrecoverable.

So my suggestion is that, after closing a file and before powering down a computer, you allow some few extra seconds for the entire process to complete and transmit to Dropbox.

I should stress that I do not use Windows, passwording, or Dropbox, so you may decide to ignore the advice I offer.

[mjlcourier]

Hi Rory, that is very helpful information. As it happens the journal document is the last thing I close at the end of most sessions, and I have sometimes wondered if I left Dropbox or Openoffice enough time to finalise the document before powering the system down, so there is likely a connection with my password-unlocking issues.

[RusselB]

While i don't use password locking a lot, I do use Dropbox with OpenOffice quite often.
Since the password encoding is part of the file that is written, if that file isn't completely written, then there's a chance that the part that wasn't written is the password.
In this case, OpenOffice would next see the file without the password, and thus would not ask for the password.
I haven't found that it takes much time to ensure that the files are written correctly, but I don't have an actual time measurement.
What I do, is I save the file. wait until I see that the Save icon has changed to a greyed status (ie: unclickable), then use File -> Exit to close OpenOffice. Out of the many reports of damaged files I've seen on this forum, I have never yet, using this methodology, lost any documents or any noticeable part of a document.

I think it's safe to say that there, probably, is a connection between a hasty power down/dropbox disconnection and the password issues.