12

I'm looking for the best way to send passwords over the internet safely. Options I've looked at are PGP and encrypted RAR files. There are no real parameters other than getting from point a to point b over the internets without too much risk.

1
  • 4
    This might sound odd, but why since someone recommended Skype and calling them, why not SMS the password over? (assuming the other side has a mobile phone, but hey who doesn't have a mobile phone nowadays?)
    – Darius
    Jul 14, 2009 at 5:57

12 Answers 12

25

PGP or another asymmetric encryption method would sound like the way to go ..

  1. both sides must publish his/her public key
  2. sign your message with your own private key
  3. encrypt with the other's public key
  4. transmit the file
  5. only the other's private key can decrypt the message
  6. your public key can be used to validate the message

=> secure & private

1
  • This is probably the best way to go- I was hoping for something the client wouldn't have to install but this is the best answer.
    – Jim B
    Jul 14, 2009 at 21:55
9

Any mechanism that uses asymmetric keys (like SSL or PGP) is good. Basically, it means that you encrypt the data (password in your case) with other person's public key, and the only way to decrypt it is to have access to the private key (which only receiver does).

The only thing to worry about PGP is who do you trust, because spoofing can easily happen when people sign their own keys.

Read the web of trust section in the wikipedia entry for PGP for more info about that.

3
  • 2
    Just to help out those who don't know what this is and are Googling it, the term is "asymmetric" key (not asynchronous), meaning that both halves of the key don't look the same. :)
    – msanford
    Jul 13, 2009 at 15:06
  • +1 because asymmetric key encryption is the best solution, and also provides a way to verify the recipient's identity (whereas an encrypted RAR doesn't, really.)
    – msanford
    Jul 13, 2009 at 15:07
  • 1
    +1 for mention of asymmetric key. I also edited your post to correct the typo.
    – KPWINC
    Jul 13, 2009 at 16:04
8

What about calling the recipient with Skype?

6
  • 2
    +1 because this is actually not a bad idea and is underused. Sure, if you have lots of keys to give out it won't work very well, but for one or two...
    – msanford
    Jul 13, 2009 at 15:04
  • 1
    Skype works well as long as the recipeint is somewhere near the same time zone. I'd normally just call using POTS but that options just not available.
    – Jim B
    Jul 13, 2009 at 19:26
  • Are you serious? Sure "better" than plain text, but no one should recommend such a thing...
    – lajarre
    Jun 26, 2013 at 13:51
  • @lajarre Care to explain? For most people Skype is going to be a perfectly acceptable method.
    – ceejayoz
    Jun 26, 2013 at 13:53
  • @ceejayoz if I understood well, this answer recommends the OP to tell the other recipient a password using his voice through Skype. I guess my reaction (which I believe is the right one when you ought to be paranoid with your passwords) derives from the fact that Skype is proprietary. Are you a good enough hacker to know if it is safe? Or do you rely on believing the Skype guys? ZRTP-based software would be a safe answer. I am not sure what "acceptable [for most people]" means...
    – lajarre
    Jun 26, 2013 at 14:23
2

You should also make sure the receiver has to change the password before being able to use whatever service it's for - authenticating the change with the sent one-time-password. This will provide further protection against theft - and/or slightly better chances at discovering one if it required the thief to change it, leaving the true user with an access denied prompt ^^

1

Send a one-time-use link, which links to a page (using SSL) where the password can be created. If anyone else discovers the link, it's likely too late for them to use the link. You'll need some kind of reset ability, just in case the link is intercepted and used before the intended recipient.

1

If you are on windows, you might want to listen to Security Now 201: SecureZip

AFAIK SecureZip implements/automates the asymmetric encryption approach I described above.

1

You might want to try NoteShred. It's a tool made pretty much for your exact need. You can create a secure note, send someone the link and password and have it "shred" it self after they read it. The note is gone and you get emailed a notification to let you know your info is destroyed.

Its free, and doesn't require any sign up.

https://www.noteshred.com

1

If it's a one-off thing, you can use my tool: http://tanin.nanakorn.com/labs/secureMessage

It uses Javascript to do RSA encryption. Therefore, your password never leaves your or your friend's machine. Please see FAQ in the above page for more info.

To do it regularly, you'd be better off using PGP or SSH keys, so that you don't have to generate a new pair of keys every time.

0

I tend to use synchronous methods for password transmition. Often I just IM someone and tell them that the password they are waiting for is xxxxxx. That way there is no identification of the server that the password works on and I can send it when I know the person is sitting there to change the password immediately.

1
  • Additionally, using IM you can use an OTR protocol-capable client like Pidgin or Adium, or use Skype which encrypts IMs (though I'm not sure of the level).
    – msanford
    Jul 13, 2009 at 15:05
0

You don't give a lot of details regarding what's needed, but I keep my passwords in a Keepass file that is stored in a Dropbox.

0

We just put out a web and mobile app to do some of this. It creates random URLs for credentials kind of like a URL shortener, using HTTPS and a hashed/AES encryption method for storage. Theres a simple API for devs, heres our writeup, maybe its the simple solution you need.. http://blog.primestudiosllc.com/security/send-time-limited-secure-logins-with-timebomb-it

-2

An HTTPS encrypted web form might work well. I would worry about the RAR file, because if someone captured the whole file they could brute force the password until it broke. Capturing and putting together an HTTPS stream isn't too easy, especially with a large keysize. They could then be stored in an encrypted database or something, possibly only retrieved through a secure web form as well.

PGP would also work, if you had some way to exchange the private keys securely and could trust that those wouldn't be compromised on the other end.

3
  • Any thoughts on how to know who's requesting that web form/page then? If the user does not know the password yet, then the user cannot authenticate either.
    – Arjan
    Jul 13, 2009 at 15:10
  • 3
    Asymmetric key encryption schemes like PGP/GPG are designed specifically so that you do NOT have to exchange your private keys. You exchange you public keys, which are called public because they should be just that, public. There is no need to hide your public keys, only your private ones. Jul 13, 2009 at 15:26
  • 1
    Sorry, I misunderstood the original question. I assumed this was for an internal thing and not for new users or something. Public key encryption would be the way to go for what you want I think.
    – Matt
    Jul 13, 2009 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .