5

Possible Duplicate:
How can clients easily and securely send me passwords?

I often need to get passwords from clients for FTP, SSH, MySQL, Authorize.net, etc.

What's an easy way for them to send me passwords securely? Maybe even without them needing a login/password?

Ideal: An easy way for non-tech-savvy people to send encrypted email.

Good: A web-based secure message system (hopefully in PHP) that I could host and run over SSL. I haven't been able to find anything like this.

Maybe I'm asking the wrong thing or the wrong way. Any suggestions are appreciated!

9
  • 2
    Perhaps this would be better on superuser? (password @ blog.stackoverflow.com/2009/07/…)
    – bdonlan
    Aug 11, 2009 at 19:33
  • 1
    No need to repost, the question can be moved automatically. If it does get moved, and there are duplicates, one or the other will get closed.
    – bdonlan
    Aug 11, 2009 at 19:54
  • be sure to link your account on superuser though, either way...
    – bdonlan
    Aug 11, 2009 at 19:55
  • Note - this question was reopened on SU as superuser.com/questions/21391/… - it should be migrated and one or the other closed as a duplicate.
    – bdonlan
    Aug 11, 2009 at 19:59
  • 1
    @Adam, karma is not shared between sites (however if you have >200 on one site, you can get a 100 bonus on the others by linking to that account). The question needs moderator intervention or two more user votes to migrate or be closed - I'd suggest going to meta.stackoverflow.com and requesting that it be closed in a support-tagged post since you can't flag or close-vote yet, and I've already flagged it for you... :/
    – bdonlan
    Aug 11, 2009 at 20:22

6 Answers 6

3

The one that works best for me is the old fashioned verbal method over a telephone.

Another easy way, which shouldn't go wrong, is two email addresses on different providers ideally.
One for usernames, One for passwords, and you get match them up by the name of the sendee, and the date/time they were sent.

4
  • I was thinking of telephone... :)
    – Anonymous
    Aug 11, 2009 at 19:42
  • then just hope that nobody has J&h7q/?9p as a password Aug 11, 2009 at 20:24
  • 2
    Stefano. What as a password? I see that as *********.
    – Vince
    Aug 11, 2009 at 20:32
  • 2
    @Bravax: He said securely.
    – arathorn
    Aug 11, 2009 at 20:44
3

A common solution is to use PGP - there's a good guide here called eMail Encryption for the Lazy. Whether it is suitable for your needs you will need to determin, but it's worth a look.

1

Use Passpack. Its a free online password manager that is very simple and very secure.

It fully supports sending encypted communications and has very strong support for sharing passwords.

They even provide a movie to help users understand how to share their data.

0

You can try this function: mcrypt-cbc.

0

There isn't an easy response. This is a basic crypto problem.

IF you and your clients already share a commom password, or a public/private key pair, you can encrypt emails using that to send other passwords.

If that isn't the case you should look for a secure mean to exchange keys. A SSL connection almost does the trick except you can't authenticate the client (nor can the client authenticte you) without previously exchanging a public/private key pair. So you can ignore this little problem and setup a ssl-accessible webpage for example, or if good security is required then a personal or phone exchange is better.

Heck, even faxing the key split into several pages, one page at a time so an eavesdropper couldn't get the whole key, might be an acceptable way.

0

Just use Skype! :) Skype chat is encrypted.

Not the answer you're looking for? Browse other questions tagged .