Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and password into separate channels under the assumption that it would be very unlikely that an eavesdropper would be sniffing both.

Is this a standard security practice, or something they just made up?

share|improve this question
    
I hope the password they send must be changed after a single use. Using random password send in plain text as the actual password that is selected defeats the purpose of it being a random ( and we can assume strong enough ) password. –  Ramhound Oct 27 '11 at 13:08

4 Answers 4

up vote 15 down vote accepted

it's fairly standard to separate the username and password into multiple instances or (better) multiple forms of communication. Some send two separate emails (lol), some send an email and a phone call for the password, you'll find all sorts of methods for separating these. But a couple things should be kept in mind.

1) any password written anywhere or sent via any method in plaintext should be assumed compromised. 2) you can help mitigate #1 by sending a temporary password, requiring the user change it on first login, else expiring in 24 hours or such

while I would follow common sense while conveying passwords, I think the end user is the highest point of risk, not the act of getting it to them.

FWIW, I've seen more than one phone company print sms msgs on the bill.... at least skype should be an ssl connection.

share|improve this answer

Yes, it is a standard practice for the basic reason you described. However if the username is sent via email and the password via skype or some other messenger then all the attacker has to do is listen on your network port for the connection to the mail server and messenger service.

You then run into problems though if the password is saved somewhere in cache or the user doesn't delete the SMS message. It's not nearly as big a problem if it's a one time password though.

share|improve this answer
    
Actually, Skype isn't that easy to intercept. Other messengers might be different, but skype sends its messages encrypted. –  tdammers Oct 28 '11 at 6:36
    
Thats why I said "or some other messenger" ;) –  Steve Oct 28 '11 at 15:01

Separating the communication channels is a good idea, but using SMS for the password, not so much. I'd rather send the username by SMS, and the password over encrypted e-mail.

share|improve this answer

It's not really a good idea to text long-term passwords, because you don't know which carriers will transport your text and how. This StackExchange question explains the standard procedure for SMS encryption but you should remember that this whole infrastructure is not in your hands; it's better to have your own encryption.

Whenever you send a credential that must last over time, you need to do so with end-to-end encryption. After all, you might not be in front of your PC when you receive the password, and if it's intercepted someone may be able to log in before you do so and set another password.

You should only text one-time passwords, and only when you're confident the device you're sending it to is in your recipient's hands. It's a bad idea to lock someone out of an account just because their phone was stolen, especially as half of all smartphone users don't protect their device with even a PIN or a gesture.

So, password texting is good as one among multiple forms of 2-Factor Authentication with one-time passwords (ideally, provide an alternative for people with stolen phones), but not for sending lost passwords or password reset links.

share|improve this answer
    
Just don't invent your own encryption method. Keep in mind there's always someone out there smarter than you who can build a better one (which you should use). –  Mast Sep 14 at 19:17
1  
I think there's a misunderstanding over what I meant by "your own". I did not mean that you must invent your own algorithm, but that if you have the choice over 2 allegedly encrypted channels and you control the end-to-end points in which the necessary encryption happens only on one of these two channels, it should be preferred security-wise. –  Steve DL 2 days ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.