Apache OpenOffice Community Forum

I was having multiple crashes and could not use my AOO 4.1.5 Calc application. After some forum searches I renamed my user profile folder and a new one was created on the first start of my calc app. I did copy the basic folder to keep my macros. It didn't crash after that anymore. But when I try to open one of my files that was password protected, to my surprise, it opened without asking any password.
Does this mean that resetting the user profile the password can be removed from the file? If that is true, this is a major bug.
Please advise.

What you describe is not possible - it cannot have happened. There is nothing in the Profile related to any password.

Edit: But see post below where a scenario not involving the User Profile could allow it to happen

See Re: Unable to open p/word protected file anymore for a description of how passwords work and you will appreciate why it could not have happened as you describe.

Basically you decide to encrypt a file with, say, zebra, as your password.

When you save with a password, AOO generates some random numbers which are stored in manifest.xml in the .ods file. AOO hashes these numbers with your zebra to produce the final_password, which will look something like sk8"<¬*5dT£oH^%*~ ... etc, but which is not stored anywhere. Hence, even if you use zebra for all your password protected files, every file will actually be encrypted with different final_password, and a different final_password will be used each time you save the same file.

This final_password is then hashed with the file to encrypt it and the encryption is stored.

When you open the file, AOO reads the stored numbers and hashes them with the zebra you supply to recreate the final_password sk8"<¬*5dT£oH^%*~ ... etc which is then used to decrypt the file.

The only things stored in the .ods file are the random numbers and the name of the method (Blowfish CFB) used to do the encryption. Neither zebra nor sk8"<¬*5dT£oH^%*~ ... etc are stored.

Resetting the profile deletes registrymodifications.xcu which holds the list of the last saved files so when you opened AOO, your list of recently saved files was empty. What may have happened is that you then navigated to the wrong file which was not password protected.

I have only one file password protected and it is that way for last 7 years. Never removed the password.
Is it possible that during the crash the system somehow saved a non password protected version of the file?

Was the password protected file open when the system crashed?

After the crashes, were you asked to recover the files?

Edit: I have just done some tests. If I open a password protected file the temporary file is password protected too so what I wrote below is not correct. I have therefore struck it out.

I ask because when a file is open, it is not password protected, and the file contents are stored in a temporary file on the disk and it is not encrypted.

If AOO then crashes, the unencrypted temporary file is left on the disk. If AOO can see it, AOO will offer to recover it when AOO restarts. If AOO does recover it, it is not encrypted and will open, and you will be returned to where you were at the moment of the crash, namely editing the file in its unprotected state.

In which case it could have happened and my post above, which was emphasising that then User Profile plays no part, does not apply.

Is it a security violation? That's an interesting debate which I could argue both ways. Highly secure applications (my password manager, for example) encrypt data held in memory to prevent things like this happening but is has a big performance impact.

Yes, it was open and I did say OK to recover. This was happening multiple times with multiple files open.