Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I often need to get passwords from clients for FTP, SSH, MySQL, Authorize.net, etc.

What's an easy way for them to send me passwords securely? Maybe even without them needing a login/password?

Encrypted IM sessions are a hassle to set up with non-techies. Phone calls break up my concentration and require arranging. (Are VOIP calls secure, anyway?)

Ideal: An easy way for non-tech-savvy people to send encrypted email. PGP/GPG doesn't cut it, unless Outlook has some super-easy built-in wizard. (You never know...?)

Good: A web-based secure message system (hopefully in PHP) that I could host and run over SSL. I haven't been able to find anything like this.

Maybe I'm asking the wrong thing or the wrong way. Any suggestions are appreciated!

share|improve this question
1  
Them knowing your password in the first place is a pretty big security issue –  Ciaran Aug 11 '09 at 19:50
1  
Note - this question is a duplicate of stackoverflow.com/questions/1262424/… (Adam apparently didn't know about the question migration feature) - if the question is migrated here to superuser, one or the other should be closed as a duplicate. –  bdonlan Aug 11 '09 at 19:55
3  
They never know my passwords, but I have to know tons of theirs, being their web developer. –  Adam DiCarlo Aug 11 '09 at 19:56
show 1 more comment

16 Answers

up vote 8 down vote accepted

your idea of a web-based messaging system could be implemented in a few dozen lines of html & php (mostly html) on any system that had an SSL web server and gpg installed. it's really just a very simple but specialised formmail type program. you could even hack an existing formmail CGI script to insert a call to gpg (assuming one doesn't already exist, try googling for formmail + gpg)

  • if you haven't already done so, install gpg on your workstation and create your public & private keys

  • create a php page that displays a form to accept a message (text field), encrypts it with gpg using your public key, and emails it to you. hard-code your email address in the script (i.e don't allow the sender to specify who to send to)

  • install the php page on an existing SSL server or create one just for the task. a self-signed cert is good enough for this job.

  • tell your client the URL when you need them to send you a login and password.

btw, thunderbird has the enigmail plugin which makes using gpg encryption very easy...but it's still probably too much trouble for casual users.

share|improve this answer
6  
Think of all the open source projects that were never open sourced because someone couldn't think of a good name! –  Robert Aug 14 '09 at 18:56
show 2 more comments

This process doesn't work in all situations, but I think it's good for multi-user systems (like a CMS or hosting control panel):

  1. Client calls you on the phone.
  2. While you're on the phone, the client logs in to the system and creates a new admin account specifically for you, rather than giving you access to their existing one.
  3. They pick a relatively simple, random (but 15+ character) passphrase for the initial password (e.g., driving to portland this weekend or where are my headphones)
  4. They tell you the passphrase over the phone.
  5. You immediately login to the system and reset the password to something truly strong, e.g., #]t'x:}=o^_%Zs3T4[ &#FdzL@y>a26pR"B/cmjV.
  6. You store the final password in your password manager.

The advantages to this approach are that:

  1. It's relatively simple for the client. They only have to know how to create an account on the system. You can walk them through that while you're on the phone if they have trouble.
  2. It's relatively simple for you also. You don't have to deal with setting up and sharing encrypted files, hosting a custom form application, etc.
  3. It uses a passphrase (as opposed to a password) so that the temporary password is easy to communicate over the phone, but is also relatively secure.
  4. The final password is never transmitted (except for the reset password form, of course, but that should be encrypted by the system).
  5. The final password is never known by the client, so they can't accidentally expose it to attackers. Of course, they can still expose their own account's password, but a post-mortem investigation of an incident would trace the penetration to their account, not yours ;)

The initial passphrase is the weakest link in the chain because of its relatively low entropy, and insecure transmission over the phone. It still has ~100 bits of entropy, though, and it only lives for 15-90 seconds. In my opinion that's good enough unless you're working on something highly sensitive, or you know that you're currently being personally targeted by a good hacker.

share|improve this answer
2  
That doesn't make sense to me. This isn't a forum thread; the whole point of Stack Exchanges sites is to build a repository of knowledge. I would think the age of the question is irrelevant. There are even badges for working on old questions, like Necromancer and Archaeologist. But, if anyone sees any flaws in my answer, please point them out so I can improve it. –  Ian Dunn Aug 2 '12 at 19:53
show 3 more comments

You might want to try NoteShred. It's a tool made pretty much for your exact need. You can create a secure note, send someone the link and password and have it "shred" it self after they read it. The note is gone and you get emailed a notification to let you know your info is destroyed.

Its free, and doesn't require any sign up.

https://www.noteshred.com

share|improve this answer
add comment

What about Cryptocat? Secure, easy to use and a browser is all you need. For details see the About page.

As Ian Dunn has pointed out, the system has the flaw that an attacker could pretend to be your client. The only security in this case would be the name of the chat room that would then become the password. Problem shifted, but not solved.

However, I often need to sent clients 30+ char salad (we call them passwords) and I mostly I use crypto.cat to exchange the credentials while talking to them on the phone. This seems to be very secure for me and the client can use CTRL+C.

share|improve this answer
1  
One of the downsides to using crypto.cat for this purpose is that you still have to share the chat room name, which essentially becomes a password in-and-of itself. If an attacker intercepted the room name, they could impersonate the client and get the system password. So now you need a way to securely share the crypto.cat password, and you're back at square one. It isn't fundamentally more secure, it just adds an extra weak layer. 2 weak layers are still better than 1, though, and if you want to keep the process simple then maybe that's an acceptable risk. –  Ian Dunn Aug 3 '12 at 15:59
show 3 more comments

How about sending the passwords via good old SMS? It's very simple and, as long as you don't provide any other information in the text, it will be very hard to figure out where it goes.

share|improve this answer
add comment

Using outlook or thunderbird with S/MIME is easy but even better is to have them call you and read you their password - if you want to be super awesome have them read part of it to you and then text you part of it and email you another part of it.

share|improve this answer
add comment

Use timebomb.it to conveniently send passwords online.

This will prevent hackers from discovering passwords by searching for "password" in the recipient's inbox or chat history months later. For really sensitive information, keep the password a secret from the non-techie for their own good.

share|improve this answer
1  
Password Pusher is a similar service. –  Ian Dunn Aug 3 '12 at 15:35
show 1 more comment

We just put out a web and mobile application to handle some of this stuff. It creates random URLs for credentials kind of like a URL shortener, using HTTPS and a hashed/AES encryption method for storage. Theres a simple JSON API too for devs, heres our writeup, give it a look.. http://blog.primestudiosllc.com/security/send-time-limited-secure-logins-with-timebomb-it

share|improve this answer
add comment

Don't overcomplicate the matter, and don't overestimate the importance of what your client is sending you.

If either computer has a key logger running, no amount of encryption will protect those precious passwords.

I wouldn't send REALLY sensitive passwords across the internet (such as an administrator's password) but for the applications you mentioned? It's not worth the effort to secure them on the off chance that someone might be intercepting your emails.

If your client is concerned, they have several options:

  1. Learn how to send encrypted emails.
  2. Send a fax, if possible.
  3. Snail mail? (lol)
  4. Speak it clearly over the phone using a Phonetic Alphabet
share|improve this answer
1  
The applications I mentioned include Authorize.net. I consider that REALLY sensitive as (forgot to mention) I'm talking the transaction key. This key allows not only accepting payments, but basically making payments (crediting customers for refunds is the purpose). Also SSH/FTP and MySQL access allows the user to blow away their website... I think that's important to protect too. You say if my client's concerned; isn't it my responsibility as a professional not to say, "Go ahead and email me your sensitive passwords?" –  Adam DiCarlo Aug 12 '09 at 19:01
1  
And since you work with websites, you should know better than most that you simply don't just store important stuff on the website. –  EvilChookie Aug 12 '09 at 23:00
show 1 more comment

This one is a bit more effort but saves the client time as well:

Set them up with something like Roboform but store the data on the web so that you can access it. When they log in somewhere RF will save the password and it's available to you.

Downsides:
*Not sure how secure online storage of Roboform is * You then have access to all of the client's passwords and they may not like that idea.

share|improve this answer
add comment

This is a combination between a text file and a phone call:

Have your client put password in a plain text file, and then drop the text file into a password-protected zip file. (7zip is free and open-source). Have them email the encrypted .zip/.rar/.7z file to you and then call with their username and the password for the zip file.

This prevents anyone from opening the zip file, and even if they did, it's only a password, which doesn't give you anything without any other information, like username and where to use it.

Additionally, this is a way to email a "forbidden" file type, like a .exe, to an email client that scans attachments and inside zips. In those cases, I usually just include the password for the zipped file in the email, and it's usually "password". It's enough to stop email software from checking the contents, though.

share|improve this answer
add comment

set up a Password Safe file in a shard Dropbox, so clients can add passwords as needed.

Joel describes the technique here

share|improve this answer
2  
Interesting idea, but it involves each client learning/using not only Password Safe but also Dropbox, and presumably separate dropboxes for each client? Don't want them seeing other people's password safe files there -- that would look bad (even though they wouldn't have the password to open others' safes). –  Adam DiCarlo Aug 12 '09 at 0:48
add comment

How about in a text file on an encrypted USB key sent via snail mail

share|improve this answer
add comment

PGP is popular.

You can also try the tried and true method of a meeting at a pond, preferably with both of you wearing trench coats.

share|improve this answer
5  
+1 for both the PGP and the "french connection" ;-) –  ldigas Aug 11 '09 at 20:03
1  
For those of you that was a FOSS version - GPG does the same. –  Dentrasi Aug 11 '09 at 20:11
4  
I was trying to avoid PGP/GPG -- this is for non tech-savvy people who don't necessarily have much time (or patience) for something involved. –  Adam DiCarlo Aug 11 '09 at 22:15
show 1 more comment

Skype's Instant Messaging is encrypted.

Now, here comes the necessary caveats: Skype is not open source so you don't know whether or not they did a terrible job or installed a government backdoor or copy all messages to Bob in IT, but the best available evidence suggests that it is secure.

share|improve this answer
show 1 more comment

I would recomend using something like axcrypt. It is very intuitive so even technically challenged people can make it work.

Download AxCrypt here

When you use AxCrypt you or whoever you are dealing with can create a file with all of the passwords/sensitive info and then encrypt it with a passphrase. I always recommend at a minimum exchanging the pass phrase over the phone or in person (This is the best option). AxCrypt uses some decent encryption, so you can be sure it will keep all but the most determined adversary out. The best part with AxCrypt is that it integrates into windows as an explorer extension. In windows explorer all you need to do is right click on the file to encrypt it/decrypt it/

Happy Hunting!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.