Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm looking for the best way to send passwords over the internet safely. Options I've looked at are PGP and encrypted RAR files. There are no real parameters other than getting from point a to point b over the internets without too much risk.

share|improve this question
4  
This might sound odd, but why since someone recommended Skype and calling them, why not SMS the password over? (assuming the other side has a mobile phone, but hey who doesn't have a mobile phone nowadays?) –  Darius Jul 14 '09 at 5:57

13 Answers 13

up vote 23 down vote accepted

PGP or another asymmetric encryption method would sound like the way to go ..

  1. both sides must publish his/her public key
  2. sign your message with your own private key
  3. encrypt with the other's public key
  4. transmit the file
  5. only the other's private key can decrypt the message
  6. your public key can be used to validate the message

=> secure & private

share|improve this answer
    
+1 good explanation. –  msanford Jul 13 '09 at 15:08
    
+1. I like this even better than my own answer, because it provides the details how it should be done. –  Milan Babuškov Jul 14 '09 at 16:11
    
This is probably the best way to go- I was hoping for something the client wouldn't have to install but this is the best answer. –  Jim B Jul 14 '09 at 21:55
    
+1 for GPG/PGP. Asymmetric encryption is really the best option here. –  Bran the Blessed Aug 28 '10 at 18:33

Any mechanism that uses asymmetric keys (like SSL or PGP) is good. Basically, it means that you encrypt the data (password in your case) with other person's public key, and the only way to decrypt it is to have access to the private key (which only receiver does).

The only thing to worry about PGP is who do you trust, because spoofing can easily happen when people sign their own keys.

Read the web of trust section in the wikipedia entry for PGP for more info about that.

share|improve this answer
2  
Just to help out those who don't know what this is and are Googling it, the term is "asymmetric" key (not asynchronous), meaning that both halves of the key don't look the same. :) –  msanford Jul 13 '09 at 15:06
    
+1 because asymmetric key encryption is the best solution, and also provides a way to verify the recipient's identity (whereas an encrypted RAR doesn't, really.) –  msanford Jul 13 '09 at 15:07
1  
+1 for mention of asymmetric key. I also edited your post to correct the typo. –  KPWINC Jul 13 '09 at 16:04
    
@KPWINC, Thanks for the correction. –  Milan Babuškov Jul 14 '09 at 16:09

What about calling the recipient with Skype?

share|improve this answer
2  
+1 because this is actually not a bad idea and is underused. Sure, if you have lots of keys to give out it won't work very well, but for one or two... –  msanford Jul 13 '09 at 15:04
1  
Skype works well as long as the recipeint is somewhere near the same time zone. I'd normally just call using POTS but that options just not available. –  Jim B Jul 13 '09 at 19:26
    
Are you serious? Sure "better" than plain text, but no one should recommend such a thing... –  lajarre Jun 26 '13 at 13:51
    
@lajarre Care to explain? For most people Skype is going to be a perfectly acceptable method. –  ceejayoz Jun 26 '13 at 13:53
    
@ceejayoz if I understood well, this answer recommends the OP to tell the other recipient a password using his voice through Skype. I guess my reaction (which I believe is the right one when you ought to be paranoid with your passwords) derives from the fact that Skype is proprietary. Are you a good enough hacker to know if it is safe? Or do you rely on believing the Skype guys? ZRTP-based software would be a safe answer. I am not sure what "acceptable [for most people]" means... –  lajarre Jun 26 '13 at 14:23

You should also make sure the receiver has to change the password before being able to use whatever service it's for - authenticating the change with the sent one-time-password. This will provide further protection against theft - and/or slightly better chances at discovering one if it required the thief to change it, leaving the true user with an access denied prompt ^^

share|improve this answer

You can use https://www.passtunnel.com to transfer a user/password pair with notes through a secure and encrypted channel.

share|improve this answer

Send a one-time-use link, which links to a page (using SSL) where the password can be created. If anyone else discovers the link, it's likely too late for them to use the link. You'll need some kind of reset ability, just in case the link is intercepted and used before the intended recipient.

share|improve this answer

If you are on windows, you might want to listen to Security Now 201: SecureZip

AFAIK SecureZip implements/automates the asymmetric encryption approach I described above.

share|improve this answer

If it's a one-off thing, you can use my tool: http://tanin.nanakorn.com/labs/secureMessage

It uses Javascript to do RSA encryption. Therefore, your password never leaves your or your friend's machine. Please see FAQ in the above page for more info.

To do it regularly, you'd be better off using PGP or SSH keys, so that you don't have to generate a new pair of keys every time.

share|improve this answer

I tend to use synchronous methods for password transmition. Often I just IM someone and tell them that the password they are waiting for is xxxxxx. That way there is no identification of the server that the password works on and I can send it when I know the person is sitting there to change the password immediately.

share|improve this answer
    
Additionally, using IM you can use an OTR protocol-capable client like Pidgin or Adium, or use Skype which encrypts IMs (though I'm not sure of the level). –  msanford Jul 13 '09 at 15:05

You don't give a lot of details regarding what's needed, but I keep my passwords in a Keepass file that is stored in a Dropbox.

share|improve this answer

We just put out a web and mobile app to do some of this. It creates random URLs for credentials kind of like a URL shortener, using HTTPS and a hashed/AES encryption method for storage. Theres a simple API for devs, heres our writeup, maybe its the simple solution you need.. http://blog.primestudiosllc.com/security/send-time-limited-secure-logins-with-timebomb-it

share|improve this answer

You might want to try NoteShred. It's a tool made pretty much for your exact need. You can create a secure note, send someone the link and password and have it "shred" it self after they read it. The note is gone and you get emailed a notification to let you know your info is destroyed.

Its free, and doesn't require any sign up.

https://www.noteshred.com

share|improve this answer

An HTTPS encrypted web form might work well. I would worry about the RAR file, because if someone captured the whole file they could brute force the password until it broke. Capturing and putting together an HTTPS stream isn't too easy, especially with a large keysize. They could then be stored in an encrypted database or something, possibly only retrieved through a secure web form as well.

PGP would also work, if you had some way to exchange the private keys securely and could trust that those wouldn't be compromised on the other end.

share|improve this answer
    
Any thoughts on how to know who's requesting that web form/page then? If the user does not know the password yet, then the user cannot authenticate either. –  Arjan Jul 13 '09 at 15:10
3  
Asymmetric key encryption schemes like PGP/GPG are designed specifically so that you do NOT have to exchange your private keys. You exchange you public keys, which are called public because they should be just that, public. There is no need to hide your public keys, only your private ones. –  Mikael Auno Jul 13 '09 at 15:26
1  
Sorry, I misunderstood the original question. I assumed this was for an internal thing and not for new users or something. Public key encryption would be the way to go for what you want I think. –  Matt Jul 13 '09 at 19:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.