I'm looking for the best way to send passwords over the internet safely. Options I've looked at are PGP and encrypted RAR files. There are no real parameters other than getting from point a to point b over the internets without too much risk.
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
PGP or another asymmetric encryption method would sound like the way to go ..
=> secure & private |
|||||||||
|
|
Any mechanism that uses asymmetric keys (like SSL or PGP) is good. Basically, it means that you encrypt the data (password in your case) with other person's public key, and the only way to decrypt it is to have access to the private key (which only receiver does). The only thing to worry about PGP is who do you trust, because spoofing can easily happen when people sign their own keys. Read the web of trust section in the wikipedia entry for PGP for more info about that. |
|||||||||||||
|
|
What about calling the recipient with Skype? |
|||||||||
|
|
You should also make sure the receiver has to change the password before being able to use whatever service it's for - authenticating the change with the sent one-time-password. This will provide further protection against theft - and/or slightly better chances at discovering one if it required the thief to change it, leaving the true user with an access denied prompt ^^ |
|||
|
|
|
You can use https://www.passtunnel.com to transfer a user/password pair with notes through a secure and encrypted channel. |
|||
|
|
|
Send a one-time-use link, which links to a page (using SSL) where the password can be created. If anyone else discovers the link, it's likely too late for them to use the link. You'll need some kind of reset ability, just in case the link is intercepted and used before the intended recipient. |
|||
|
|
|
If you are on windows, you might want to listen to Security Now 201: SecureZip AFAIK SecureZip implements/automates the asymmetric encryption approach I described above. |
|||
|
|
|
I tend to use synchronous methods for password transmition. Often I just IM someone and tell them that the password they are waiting for is xxxxxx. That way there is no identification of the server that the password works on and I can send it when I know the person is sitting there to change the password immediately. |
|||
|
|
You don't give a lot of details regarding what's needed, but I keep my passwords in a Keepass file that is stored in a Dropbox. |
|||
|
|
|
We just put out a web and mobile app to do some of this. It creates random URLs for credentials kind of like a URL shortener, using HTTPS and a hashed/AES encryption method for storage. Theres a simple API for devs, heres our writeup, maybe its the simple solution you need.. http://blog.primestudiosllc.com/security/send-time-limited-secure-logins-with-timebomb-it |
|||
|
|
|
You might want to try NoteShred. It's a tool made pretty much for your exact need. You can create a secure note, send someone the link and password and have it "shred" it self after they read it. The note is gone and you get emailed a notification to let you know your info is destroyed. Its free, and doesn't require any sign up. |
|||
|
|
|
An HTTPS encrypted web form might work well. I would worry about the RAR file, because if someone captured the whole file they could brute force the password until it broke. Capturing and putting together an HTTPS stream isn't too easy, especially with a large keysize. They could then be stored in an encrypted database or something, possibly only retrieved through a secure web form as well. PGP would also work, if you had some way to exchange the private keys securely and could trust that those wouldn't be compromised on the other end. |
|||||||||||
|
