Whether to enable a security-protected feature

Question

An Excel spreadsheet needs programmatic access to its Project structure. However, this access is disabled by default. It can be enabled programmatically, by writing to the registry with this snippet:

Set wsh = CreateObject("WScript.Shell")
'key to modify'
str1 = "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\" & Application.Version & "\Word\Security\AccessVBOM"
'enable access'
wsh.RegWrite str1, 1, "REG_DWORD"
'read the vba project name'
MsgBox Application.NormalTemplate.VBProject.Name
'disable access'
wsh.RegDelete str1

Although it can be done (and reset) programmatically, this could create a security issue.

In my project, it attempts to modify the Project structure, and throws an error if it cannot. The error can be caught, and at this point it can either run the snippet to enable access or display an error message to the user to enable access manually. Is it better to enable the access via the program, where it can be disabled later, or instruct the user to do so?

Answer 1

It seems to me that the fact it can be done programmatically is a security issue. Given the existence of such a simple mechanism to override the default "protection", you're not exposing the user to a significantly greater risk by turning it off. Any virus writer worth their salt would be doing this anyway.

That said, turning it off for 20 seconds while you do your work and then turning it on again leaves the (broken) window open for far less time than asking the user to turn it off.

I'd be inclined to ask the user for permission to turn it off temporarily, and then make damn sure that I turned it back on again (since leaving it off would be a no-no).

Answer 2

Well, two things: It's pretty well known you can modify office security settings via the registry. So Office circumvents this by only reading the settings when the file opens. So if you change the settings with your code you will also need to close and reopen the file for the setting to take effect. Secondly tampering with the users security settings would be considered "rude" software. If the user want's to allow your code they will. Simply prompt them to enable the setting and restart the program. Anything past that would be considered poor behavior.
Remember, just because you can, doesn't mean you should:)