How can clients easily and securely send me passwords?

Question

I often need to get passwords from clients for FTP, SSH, MySQL, Authorize.net, etc.

What's an easy way for them to send me passwords securely? Maybe even without them needing a login/password?

Encrypted IM sessions are a hassle to set up with non-techies. Phone calls break up my concentration and require arranging. (Are VOIP calls secure, anyway?)

Ideal: An easy way for non-tech-savvy people to send encrypted email. PGP/GPG doesn't cut it, unless Outlook has some super-easy built-in wizard. (You never know...?)

Good: A web-based secure message system (hopefully in PHP) that I could host and run over SSL. I haven't been able to find anything like this.

Maybe I'm asking the wrong thing or the wrong way. Any suggestions are appreciated!

Answer 1

your idea of a web-based messaging system could be implemented in a few dozen lines of html & php (mostly html) on any system that had an SSL web server and gpg installed. it's really just a very simple but specialised formmail type program. you could even hack an existing formmail CGI script to insert a call to gpg (assuming one doesn't already exist, try googling for formmail + gpg)

• if you haven't already done so, install gpg on your workstation and create your public & private keys

• create a php page that displays a form to accept a message (text field), encrypts it with gpg using your public key, and emails it to you. hard-code your email address in the script (i.e don't allow the sender to specify who to send to)

• install the php page on an existing SSL server or create one just for the task. a self-signed cert is good enough for this job.

• tell your client the URL when you need them to send you a login and password.

btw, thunderbird has the enigmail plugin which makes using gpg encryption very easy...but it's still probably too much trouble for casual users.

Answer 2

Over the phone.

Answer 3

PGP is popular.

You can also try the tried and true method of a meeting at a pond, preferably with both of you wearing trench coats.

Answer 4

Don't overcomplicate the matter, and don't overestimate the importance of what your client is sending you.

If either computer has a key logger running, no amount of encryption will protect those precious passwords.

I wouldn't send REALLY sensitive passwords across the internet (such as an administrator's password) but for the applications you mentioned? It's not worth the effort to secure them on the off chance that someone might be intercepting your emails.

If your client is concerned, they have several options:

1. Learn how to send encrypted emails.
2. Send a fax, if possible.
3. Snail mail? (lol)
4. Speak it clearly over the phone using a Phonetic Alphabet

Answer 5

Skype's Instant Messaging is encrypted.

Now, here comes the necessary caveats: Skype is not open source so you don't know whether or not they did a terrible job or installed a government backdoor or copy all messages to Bob in IT, but the best available evidence suggests that it is secure.

Answer 6

set up a Password Safe file in a shard Dropbox, so clients can add passwords as needed.

Joel describes the technique here

Answer 7

This is a combination between a text file and a phone call:

Have your client put password in a plain text file, and then drop the text file into a password-protected zip file. (7zip is free and open-source). Have them email the encrypted .zip/.rar/.7z file to you and then call with their username and the password for the zip file.

This prevents anyone from opening the zip file, and even if they did, it's only a password, which doesn't give you anything without any other information, like username and where to use it.

Additionally, this is a way to email a "forbidden" file type, like a .exe, to an email client that scans attachments and inside zips. In those cases, I usually just include the password for the zipped file in the email, and it's usually "password". It's enough to stop email software from checking the contents, though.

Answer 8

Use timebomb.it to conveniently send passwords online.

This will prevent hackers from discovering passwords by searching for "password" in the recipient's inbox or chat history months later. For really sensitive information, keep the password a secret from the non-techie for their own good.

Answer 9

How about in a text file on an encrypted USB key sent via snail mail

Answer 10

We just put out a web and mobile application to handle some of this stuff. It creates random URLs for credentials kind of like a URL shortener, using HTTPS and a hashed/AES encryption method for storage. Theres a simple JSON API too for devs, heres our writeup, give it a look.. http://blog.primestudiosllc.com/security/send-time-limited-secure-logins-with-timebomb-it

Answer 11

This one is a bit more effort but saves the client time as well:

Set them up with something like Roboform but store the data on the web so that you can access it. When they log in somewhere RF will save the password and it's available to you.

Downsides:
*Not sure how secure online storage of Roboform is * You then have access to all of the client's passwords and they may not like that idea.

Answer 12

I would recomend using something like axcrypt. It is very intuitive so even technically challenged people can make it work.

Download AxCrypt here

When you use AxCrypt you or whoever you are dealing with can create a file with all of the passwords/sensitive info and then encrypt it with a passphrase. I always recommend at a minimum exchanging the pass phrase over the phone or in person (This is the best option). AxCrypt uses some decent encryption, so you can be sure it will keep all but the most determined adversary out. The best part with AxCrypt is that it integrates into windows as an explorer extension. In windows explorer all you need to do is right click on the file to encrypt it/decrypt it/

Happy Hunting!