88

Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have to send an email every year to follow up with the account controller in order to get the new password. This always ends in a phone call, because their policy is to not send passwords through email.

I have a vague understanding of why sending passwords through email is bad, but honestly I don't understand why telling someone a password over a phone would be any better. Assuming I have a 0% chance to change their policy (I really have no chance), why would telling someone a password over a phone call be more secure than email?

I am primarily focused on the ability for phone/email to be intercepted by a third party, but @Andrew raised a good point about the permanency of email.

There is some great information in this Q/A, but that question is about the most secure way to send login information, while I'm specifically asking about phone call vs email security.

Improve this question
8
  • 33
    A phone call is usually not recorded for indefinite history, whereas an email is usually not deleted. The transport security of either depends on a lot of things (phone: was it a landline, 2G/3G/4G, VoIP; email: does SMTP use TLS, does the client use TLS, etc.)
    – Luc
    Commented Aug 16, 2018 at 17:44
  • 19
    @dandavis Just because your connection to gmail or whatever is secure does not mean the message will be encrypted all the way to the destination. superuser.com/questions/260002/…
    – nasch
    Commented Aug 16, 2018 at 22:47
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Commented Aug 20, 2018 at 8:33
  • 2
    If only there was a secure channel ... such as the already existing VPN
    – Hagen von Eitzen
    Commented Aug 20, 2018 at 21:52
  • 1
    A couple of key points to remember when talking about passwords being more secure is that if the end user has the phone on speaker, repeats the password or writes it down so they remember it the extra security from it not going over email can be lost especially if it is a password they are not forced to change or can't change. Another key point is that not everyone can use the phone such as deaf, hearing impaired and people who have lost their voice for some reason which means that other means of giving the user a password is needed.
    – Joe W
    Commented Aug 21, 2018 at 0:48

12 Answers 12

Reset to default
121

Emails are saved somewhere, whether it be on a mail server or someone's personal computer. Phone calls usually are not, unless it's a customer facing environment.

Improve this answer
17
  • 2
    Easy to read an email over your shoulder, not as easy for a phone call.
    – Der Kommissar
    Commented Aug 16, 2018 at 20:22
  • 44
    As a matter of policy, my company records all phone calls, incoming and outgoing. The records are saved on the cloud behind credentials, and if an admin or the user who made the call wants, they can download the recording and send it via email. While it's not a common occurrence, it does happen.
    – user152124
    Commented Aug 16, 2018 at 20:27
  • 12
    @JM-AGMS Even in that case, it's harder to scan a whole audio repository for a password than a text repository. Although... I guess you could pass an audio-to-text process to the whole thing and then look for words similar to "password"
    – xDaizu
    Commented Aug 17, 2018 at 11:31
  • 3
    It's illegal to record phone calls. This has been on the law books since shortly after there were phones. In some states it requires all-party consent. In other states 1-party, but that still means the system can't record all calls with 0-party consent. If it's an interstate call, the most restrictive law applies.
    – Harper - Reinstate Monica
    Commented Aug 18, 2018 at 0:01
  • 5
    @Harper That is just the USA. In the UK it is common for phone calls to be recorded with just notice, rather than consent.
    – Jon Bentley
    Commented Aug 18, 2018 at 23:26
58

This policy is common where usernames and passwords are sent via separate channels.

It doesn't matter which channels just as long as it the authentication pairs are split apart and sent via different methods.

This is the accepted best practice because intercepting the right two channels is much harder than watching one channel for the authentication pair to simply pass by.

The reasoning behind this is password changes are not just when you forget a password but when there is suspicion that an account has been compromised. For this reason password changes are done "out of band" to ensure that password updates are not easily captured.

In the world of IT security it is sometimes not about being perfectly secure. It is acceptable to be just hard enough to have attackers go try somewhere else.

Improve this answer
2
  • +1 Adding to this: If it's easier for an attacker to defeat the password reset mechanism than to guess / phish your password, then your site isn't really password protected, is it?
    – Mike Ounsworth
    Commented Aug 21, 2018 at 17:35
  • 2
    Agreed (and upvoted!): the answer is "separate channels" :) I'd slightly nitpick the last paragraph, though, in that it's not so much that people will "try somewhere else", as that "defense in depth" is all about layered security, no one layer of which can be a complete defense against all possible attacks.
    – Dewi Morgan
    Commented Aug 23, 2018 at 14:19
56

Emails may (though as @Luc points out, not always) be sent in plaintext across the internet. That means they may be logged by your email provider, your ISP, your recipient's ISP, your recipient's email provider, or any of the networking equipment in-between. As the sender, you also have no control over who is looking over the shoulder of the person as they open the email.

With a phone call, you have more control over verifying that you are talking to the correct person, they can can refuse to answer if they are in a public place, etc. Plus, while there are no guarantees that it's not being recorded, at least there's a good chance -- unlike email which has 100% chance of being in some database somewhere.

Improve this answer
18
  • 5
    However, a lot of VoIP is transported unencrypted over LANs and the Internet. And on the TDM side of the phone network, there's no encryption or authentication whatsoever.
    – user71659
    Commented Aug 16, 2018 at 18:07
  • 5
    @user71659 Fair enough. I have no experience in telephony. With text logs from email servers etc, it's super easy to ctrl+f for passwords. Assuming an unencrypted telephone network and / or VoiP packets, is it similarly easy to extract the password?
    – Mike Ounsworth
    Commented Aug 16, 2018 at 18:09
  • 3
    Note that we are talking about a company here. Presumably internal email will never leave their premises. So yeah I point out that it's not always sent in plaintext, but for completeness, in this particular scenario it's actually likely that it is sent securely. Phone calls, on the other hand, almost always leave the premises since people usually only call via mobile phones these days (again, the case is different for internal VoIP or DECT, or in the case of CCC: GSM)
    – Luc
    Commented Aug 16, 2018 at 18:23
  • 5
    @Luc Not in the US. My opinion is a desk phone is more comfortable to use, has better acoustics, doesn't use heavy speech compression, doesn't have dropouts. It's a far more professional experience. You also have issues when somebody needs to call 911, and with coverage, like an office in a basement. The US also, until a few years ago, had tax issues writing off cell phones.
    – user71659
    Commented Aug 16, 2018 at 18:29
  • 6
    @user71659 A VoIP attacker needs to have a pre-established presence to proxy the session, have access to dump an intermediary network interface, or is stuck trying to falsify one party and force a session renegotiation live. You need to have a fairly significant presence or a lot of set-up time to do that. It's certainly not impossible, but I'd call that a much more sophisticated attack, and most certainly one that's much more difficult to do without leaving evidence.
    – Iron Gremlin
    Commented Aug 17, 2018 at 1:06
32

Even if both the email and phone conversation are recorded, it is orders of magnitude easier to search an email database for "password" than it is to search voice recordings.

However, best practices say that one, and only one person should know the password for an account, and that is the person who owns the account. The admin should not know it, nor should the server (i.e. hashed password).

The usual way to do this would be: if the password has recently (for a given value of recently) expired, the user can use their old password, but immediately on being authenticated (before logging in), they are forced to change their password, then immediately disconnected. If the password has expired some time ago, the administrator can mark the expired password as "recently expired" for a short period of time - (e.g. 10 minutes). The administrator does not need to know what this password is. If the user has forgotten their password, the administrator can issue a short time (e.g 10 minute) password which also forces immediate change of password.

Also, if a user has changed their own password in the last year, they should be exempt from the change (until exactly 1 year after their last change).

The theory that a password should be changed once per year is also exceedingly dubious, in most cases - if a password is compromised, it is usually maximally exploited immediately. Only giving an attacker "only" 6 months of access (on average) seems fairly pointless (or "only" 6 days for that matter). This suggests 2-factor authentication, with the second factor being unique each time (Google Authenticator, OTP, OPIE, challenge-response etc), if the resource is worth protecting.

An admin should not know a user's password, if it can be avoided. If needed, they should have the ability to become another user with their OWN password, which is then written to an audit log. This is especially important if there are several levels of "administrator" (i.e. if there are people who can change passwords, but not affect the audit log).

Minor obfuscations (such as security by audio, image etc), are dangerous, because they foster complacency without security.

Improve this answer
1
  • 16
    Yes, though it would be easy enough to add a hurdle here by only sending an image file with the name kitten.gif which actually contains a “screenshot” of the text new password: pwd1234. A determined attacker will be able to crack this just as well as a phone recording, but not simply with grep. Either method is only security through obscurity.
    – leftaroundabout
    Commented Aug 17, 2018 at 13:22
12

In a secure system, passwords provided by IT should only be temporary, one time use only, random strings, so the user has to immediately type it in and change it to their own new secret password. IT should never know or transmit a user's "real" password.

Users need to be vetted prior to the reset and that is much easier done by voice call, ask a question, get an answer, done.

Even if the temp. password is overheard on a call, there would not be any time for it to be used. Emails, however are sometimes neglected for some time before being read, giving an attacker the chance to do their worst.

Additionally, a recorded voice call can be used to identify if a user has been impersonated later on, whereas you can't tell who looked at an open email screen or remote email server.

My 10 years of experience are in a financial institution environment so this level of security may not be economically justified if security needs are less stringent. Paying for IT bodies is expensive and most systems/apps are going to web based security anyway, so the days of IT password resets by voice are numbered in any event.

Improve this answer
1
  • 1
    I agree with your answer, but sadly there is no password management from the end-user side in this VPN system. So IT sets the password and the changes it every year. It’s not a secure system in the slightest, since IT knows all user passwords. Worse, the password wasn’t high-entropy (8 characters and 2 numbers, no symbols).
    – Chris Cirefice
    Commented Aug 18, 2018 at 15:47
8

The security of an email is hard to establish. The email is most likely kept in archives (there are even some regulations for certain companies). So sending a password in an email is a bad idea from that standpoint. Email intercept could also happen.

Phone on the other hand, is less likely to be recorded, but phone intercept or recording could exist. So it isn't that great of an idea. I read a comment that land line are harder to tap than computer systems - I would disagree. Taping a traditional phone line is much simpler than hacking a remote server. VOIP phones require new technique but not that hard either - plug a hub, connect your PC to one port of the hub, and you now have a copy of all packets, and VOIP decoding software abound. It's probably harder to intercept a cell phone signal, but I don't know, haven't done it.

One (maybe perceived) benefit of using the phone over the email is the assurance that you are giving the password to the person you want to give the password to. Being a system administrator myself, who has to reset passwords, this is something I can attest to. If you send an email, you don't really know who is on the other end. It could be a spoofed email, hijacked account, etc. If you know the person, you can recognize the person's voice. You can ask some questions to verify authenticity (you could do that on email too but there is a safety feeling when doing it over the phone).

Now, having an Administrator set a password and that remain the password and not let the user set their own password is really bad practice in my opinion due to these factors of now the password has to be transmitted and whatever is transmitted is going to be the password forever after.

Improve this answer
3

Is there more to the policy? In many organizations they will give a new password over the phone but they must know the persons voice and answer a question (who is your boss, when was your last review).

It's somewhat similar to a multi-factor authentication process.

Improve this answer
2

The logic I use when insisting on using phone or text to send the password is the fact it's a second channel.

Even with all of the insecurities detailed above of email, if the email was sent with only the password in it, there is not enough information for malicious use. However, if you intercept an email that has a similar meaning to "Your password for account xxx on service yyy has been changed to zzz", you have everything you need to access the account.

Improve this answer
1
  • 2
    You're assuming the email is coming from an address at a different domain. If an attacker gets an email with a password from "[email protected]" to "[email protected]", the first thing they would try is signing into example.com with username "alice" and the password from the email.
    – AndrolGenhald
    Commented Aug 16, 2018 at 21:55
1

At the moment, it is far easier to intercept an email. This can change in the future, but for now:

  • Emails are designed to be stored for arbitrarily long periods of time. You can expect that at least one, if not several servers saved off all of the data.
  • Emails are easier to process. Identifying emails containing passwords is relatively easy. Identifying them in phone calls is harder. If an adversary is listening in, it's obviously going to be trivial to capture the password. However, listening in requires more resources.
    • At some point, AI is going to make this much easier. But that does not seem to be the case at the moment.

It really does depend on your threat model. How valuable is this password? I would assume the banking credentials of a billionaire would be protected better than this, or classified information, but the smaller one is, the more the resources invested in getting the information start to matter.

Improve this answer
3
  • It isn't easier to intercept an email. It's much easier to intercept a phone call over an analogue line than it is to get into the data path of an email transaction — and furthermore, email servers actually often do use encryption when transferring messages.
    – al45tair
    Commented Aug 23, 2018 at 12:41
  • @alastair Is that true even when one does not know which particular email or phone call was important? Offhand, it seems easier to capture and process a million emails than it takes to capture and process a hundred phone calls. At the very least we do indeed act on the illusion that what I say is true. In the US attorney-client confidentiality is legally protected if you took enough efforts to protect the communication. It is deemed "sufficiently protected" for a landline phone call, but emails are not.
    – Cort Ammon
    Commented Aug 23, 2018 at 14:19
  • 1
    Processing phone calls is certainly harder, but I think capturing calls is easier. I think if you concentrate on the computer/data networking side of things it might not seem that way, but then you've forgotten all the old-fashioned methods of listening in on telephone conversations, which are generally very much easier than hacking network gear to intercept packets. Processing isn't catastrophically difficult either (just requires speech recognition, or manpower; even Mechanical Turk would work).
    – al45tair
    Commented Aug 29, 2018 at 15:01
1

The main catch on a phone call is that phone calls are still susceptible to social engineering attacks, where a caller can cajole a trusted individual to give them access

On the phone, I selected an automated menu to “get help with logging in to my account”. The customer service rep, Christine, was very friendly and asked me for my email and home address in order to work with me to get access to my account.

I think we found our problem… Christine only needed these two pieces of information to get me into my account? No password? No mobile phone? No other piece of information? What’s keeping someone from finding my email and home address from a database and calling to take over my account?

So nobody can sniff out your email (potentially unencrypted), but all I need is their phone number and a little bit of info about you and I could be doing this

Hello, this is Chris Cirefice. I've lost my VPN login again. I coulda swore I wrote it down, can you give me a new one? Wow, that would be great, let me get a pen and paper...

Improve this answer
0

There are several good answers about why sending Password = -value- in an email are bad.

BUT

No one is mentioning that if the password is simple enough to easily be communicated by voice it is probably not complex enough to be effective and the receiving party is probably going to write on a piece of paper...

Related XKCD #936: Short complex password, or long dictionary passphrase?

Improve this answer
6
  • 6
    There's nothing wrong with writing passwords on a piece of paper. A lot of secure information gets written on pieces of paper. It's what steps you take to ensure that only the right people can see the piece of paper that matters.
    – Michael Kay
    Commented Aug 17, 2018 at 22:03
  • 2
    Given that communicating long serial numbers or contract support numbers, 16+ characters in length, is fairly routine over the phone, I don't see why communicating a 16+ character password would be more difficult. Yes, they will write the complex password down but they will do that anyway if they get it via email.
    – doneal24
    Commented Aug 18, 2018 at 16:05
  • @DougO'Neal A password should also contain special characters, the names of which most people (or at least me) are not familiar with .
    – James Jenkins
    Commented Aug 18, 2018 at 23:54
  • 5
    Also, nobody seems to be questioning the notion that the user isn't allowed to change their own password to something only they know.
    – Michael
    Commented Aug 19, 2018 at 16:19
  • @schroeder read the question again. This is not a temporary password, this is an annual required change, with the password provided by the caller. The OP does not have the option to change it.
    – James Jenkins
    Commented Sep 23, 2018 at 23:42
-4

Emails are generally not saved, however wireless signals can be hacked, as well as wiretapping landlines. best way to do this is with an https website.

Improve this answer
5
  • 6
    Welcome. "Emails are generally not saved" - this is an odd opinion to me since email servers will log or store emails for extended amounts of time (certainly more than a year), and the emails will exist in the sender's "sent" box until specifically purged. Yes, Wireless signals can be hacked, but the skill and timing involved seems to be a significant barrier.
    – schroeder ♦
    Commented Aug 19, 2018 at 21:54
  • Companies are not-uncommonly required to save emails. And from my experience, they'll do it even if they don't actually have to.
    – cHao
    Commented Aug 22, 2018 at 2:20
  • :-) Emails are generally saved, one way or another, sometimes long-term. However, I think the crux of the matter here is that it's a good bet that most attackers will not be able to compromise both email and telephony, so using two separate routes to communicate username and password is a security win. This still won't protect against all attackers; if your adversary is a nation state, you might want to take still more extreme measures.
    – al45tair
    Commented Aug 23, 2018 at 12:45
  • IT WAS A TYPO OK
    – bluninja1234
    Commented Sep 8, 2018 at 23:26
  • MINUS THE NOT PEOPLE SORRY GUYS
    – bluninja1234
    Commented Sep 8, 2018 at 23:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .