I'm looking for the best way to send passwords over the internet safely. Options I've looked at are PGP and encrypted RAR files. There are no real parameters other than getting from point a to point b over the internets without too much risk.
PGP or another asymmetric encryption method would sound like the way to go ..
- both sides must publish his/her public key
- sign your message with your own private key
- encrypt with the other's public key
- transmit the file
- only the other's private key can decrypt the message
- your public key can be used to validate the message
=> secure & private
Any mechanism that uses asymmetric keys (like SSL or PGP) is good. Basically, it means that you encrypt the data (password in your case) with other person's public key, and the only way to decrypt it is to have access to the private key (which only receiver does).
The only thing to worry about PGP is who do you trust, because spoofing can easily happen when people sign their own keys.
Read the web of trust section in the wikipedia entry for PGP for more info about that.
What about calling the recipient with Skype?
You should also make sure the receiver has to change the password before being able to use whatever service it's for - authenticating the change with the sent one-time-password. This will provide further protection against theft - and/or slightly better chances at discovering one if it required the thief to change it, leaving the true user with an access denied prompt ^^
Send a one-time-use link, which links to a page (using SSL) where the password can be created. If anyone else discovers the link, it's likely too late for them to use the link. You'll need some kind of reset ability, just in case the link is intercepted and used before the intended recipient.
You might want to try NoteShred. It's a tool made pretty much for your exact need. You can create a secure note, send someone the link and password and have it "shred" it self after they read it. The note is gone and you get emailed a notification to let you know your info is destroyed.
Its free, and doesn't require any sign up.
If it's a one-off thing, you can use my tool: http://tanin.nanakorn.com/labs/secureMessage
To do it regularly, you'd be better off using PGP or SSH keys, so that you don't have to generate a new pair of keys every time.
I tend to use synchronous methods for password transmition. Often I just IM someone and tell them that the password they are waiting for is xxxxxx. That way there is no identification of the server that the password works on and I can send it when I know the person is sitting there to change the password immediately.
You don't give a lot of details regarding what's needed, but I keep my passwords in a Keepass file that is stored in a Dropbox.
We just put out a web and mobile app to do some of this. It creates random URLs for credentials kind of like a URL shortener, using HTTPS and a hashed/AES encryption method for storage. Theres a simple API for devs, heres our writeup, maybe its the simple solution you need.. http://blog.primestudiosllc.com/security/send-time-limited-secure-logins-with-timebomb-it
An HTTPS encrypted web form might work well. I would worry about the RAR file, because if someone captured the whole file they could brute force the password until it broke. Capturing and putting together an HTTPS stream isn't too easy, especially with a large keysize. They could then be stored in an encrypted database or something, possibly only retrieved through a secure web form as well.
PGP would also work, if you had some way to exchange the private keys securely and could trust that those wouldn't be compromised on the other end.