How secure is SaveSetting?

[Greg Lovern]

How secure is data saved to HKCU\Software\VB and VBA Program Settings
(using Excel's SaveSetting)?

I want to store user data securely. If a user logs in and saves data
using my Excel VBA to HKCU\Software\VB and VBA Program Settings, is
there any way another user can get that data without knowing the first
user's Windows login credentials?

I tested by storing a unique string there, then logging off and
logging in as another user, and searching the registry for that
string. It was not found. I also tried enabling the Administrator
account (net user Administrator /active:yes), and searching the
registry while logged in as the Administrator. Still not found.

So Windows doesn't make it easy to get other user's data there. But
can find they it any other way?


Thanks,

Greg

 

[Greg Lovern]

could you not encrypt it as well?

Sure, but since any Excel VBA password can be easily and quickly
cracked, any encryption and decryption I did in Excel VBA could be
observed and copied.


Thanks,

Greg

 

[Anthony Berglas]

I think it should be fairly secure to non priviliged users. Log in as
the other user, and do a full registry search for the data value it
stored. It should be there, under the different user's id, but should
not be accessible. Of course, you need to be adminsitrator to search
the registry with Regedit. So then check you cannot access it as an
ordinary user.

That said, I would not totally trust it -- encrypt as well if it is
important to you. Or store it in a file under %APPDATA%.

Anthony