Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing both in one email? Thank you in advance.

share|improve this question
No law I'm aware of, except those that might enforce policies on some particular organizations which forbid sending passwords via e-mail at all. In any case, passwords should not be sent via cleartext e-mail. – Iszi Jan 16 at 19:29
Things get more interesting if you're subject to regulation (SOX etc) where internal controls may require it. – makerofthings7 Jan 16 at 19:48
Even if there is no law against it, it's a BAD idea. stackoverflow.com/questions/1069722/… – David Stratton Jan 16 at 20:27
Best practice? minimal practice! Private keys and password have to not travel on public internet roads! No laws, but many enterprises conditions (mostly by signed contracts). – F. Hauri Jan 17 at 1:10
There is the law of common sense. Sending a password over an insecure communication channel is a violation of common sense. – Zoredache Jan 17 at 20:22

3 Answers

up vote 1 down vote

If there is, it would be industry-specific. For example, the laws regulating nuclear reactors may be different from the ones regulating flower shops. As far as I know, there is no general federal law in the United States prohibiting you from sending credentials over email, even in the same message.

share|improve this answer
There are very few federal laws dealing with content within an email. Of course doing what the author is asking is a horrible idea. – Ramhound Jan 17 at 17:17
up vote 1 down vote

Personally, any system that requires a password from an end-user should have a method of setting/re-setting that password without the need to send anything to the user, such as the user selecting a password upon registration, and then being able to reset and choose another password, preferably by confirming other details that were setup during registration such as secret questions etc. This would ensure that if someone wanted to get at the password, they would either need to compromise the system (hash/salt anyone?) or compromise the users machine or network.

share|improve this answer
up vote 0 down vote

No - there is no law against it, but sending the two at once effectively gives the recipient of that email, or anyone who intercepts it, access.

By separating them, an attacker will need to intercept two messages, and if the two are sent by different media (eg an email and an SMS message) the attacker has an even more difficult task.

share|improve this answer
1  
I would point out that sending two emails to and from the same address is no better than sending one email, since if one is intercepted, the other almost certainly will be as well. Using two different channels of communication (e.g. email and IM, email and phone, SMS and IM) is much harder to intercept. – tylerl Jan 17 at 0:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.