Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and password into separate channels under the assumption that it would be very unlikely that an eavesdropper would be sniffing both.

Is this a standard security practice, or something they just made up?

share|improve this question
    
I hope the password they send must be changed after a single use. Using random password send in plain text as the actual password that is selected defeats the purpose of it being a random ( and we can assume strong enough ) password. –  Ramhound Oct 27 '11 at 13:08
add comment

3 Answers

up vote 14 down vote accepted

it's fairly standard to separate the username and password into multiple instances or (better) multiple forms of communication. Some send two separate emails (lol), some send an email and a phone call for the password, you'll find all sorts of methods for separating these. But a couple things should be kept in mind.

1) any password written anywhere or sent via any method in plaintext should be assumed compromised. 2) you can help mitigate #1 by sending a temporary password, requiring the user change it on first login, else expiring in 24 hours or such

while I would follow common sense while conveying passwords, I think the end user is the highest point of risk, not the act of getting it to them.

FWIW, I've seen more than one phone company print sms msgs on the bill.... at least skype should be an ssl connection.

share|improve this answer
add comment

Yes, it is a standard practice for the basic reason you described. However if the username is sent via email and the password via skype or some other messenger then all the attacker has to do is listen on your network port for the connection to the mail server and messenger service.

You then run into problems though if the password is saved somewhere in cache or the user doesn't delete the SMS message. It's not nearly as big a problem if it's a one time password though.

share|improve this answer
    
Actually, Skype isn't that easy to intercept. Other messengers might be different, but skype sends its messages encrypted. –  tdammers Oct 28 '11 at 6:36
    
Thats why I said "or some other messenger" ;) –  SteveS Oct 28 '11 at 15:01
add comment

Separating the communication channels is a good idea, but using SMS for the password, not so much. I'd rather send the username by SMS, and the password over encrypted e-mail.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.