Is it “standard” to SMS passwords?

Question

When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and password into separate channels under the assumption that it would be very unlikely that an eavesdropper would be sniffing both.

Is this a standard security practice, or something they just made up?

Answer 1

it's fairly standard to separate the username and password into multiple instances or (better) multiple forms of communication. Some send two separate emails (lol), some send an email and a phone call for the password, you'll find all sorts of methods for separating these. But a couple things should be kept in mind.

1) any password written anywhere or sent via any method in plaintext should be assumed compromised. 2) you can help mitigate #1 by sending a temporary password, requiring the user change it on first login, else expiring in 24 hours or such

while I would follow common sense while conveying passwords, I think the end user is the highest point of risk, not the act of getting it to them.

FWIW, I've seen more than one phone company print sms msgs on the bill.... at least skype should be an ssl connection.

Answer 2

Yes, it is a standard practice for the basic reason you described. However if the username is sent via email and the password via skype or some other messenger then all the attacker has to do is listen on your network port for the connection to the mail server and messenger service.

You then run into problems though if the password is saved somewhere in cache or the user doesn't delete the SMS message. It's not nearly as big a problem if it's a one time password though.

Answer 3

Separating the communication channels is a good idea, but using SMS for the password, not so much. I'd rather send the username by SMS, and the password over encrypted e-mail.