Sharing passwords through email can be considered insecure?

Question

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need to tell me it or I should change it and tell him. In any case, the password has to be send.

So far I've been using email, but I'm not sure whether this is an appropriate way. Web services usually send your password to your email, but also you are allowed to change the password. In this case, it's for intranet applications and in order to change the password, always someone else needs to know the password as well.

When the new account is for someone placed at my location, I just approach him and tell him his login information, but there are many locations within this intranet, so often approach the new user is impossible.

PS: colleagues were using Skype as well.

Answer 1

Email is insecure. Emails can be lost, misdirected, eavesdropped and faked. Sending a password by email is a big vulnerability.

"We" do it nonetheless because in some situations alternatives are just worse for usability reasons. And we apply mitigation measures:

• The password is temporary and does not allow access directly; it only gives access to a "password change" interface, this time through some protected tunnel (HTTPS...).

• If the temporary password has not been used within a small amount of time, it is deactivated, and an alarm is raised.

• The temporary password is deactivated automatically after usage.

• Users are trained to raise alarms when they fail to receive an expected password by email, or when they try to use it and find that it is already deactivated.

Using Skype messages to transmit the temporary password might be a better idea. Skype messages are less routinely eavesdropped by amateur attackers, because they are encrypted, making the spying harder (details are not published but that's still better than no encryption at all). On the other hand, there is suspicion that Skype messages are routinely inspected by some governmental agencies (of various governments) who were given some backdoor access. That way, you get to choose the kind of attacker who can spy on the temporary passwords...

Spelling out passwords by phone may be a good idea, too. Phone lines are no safer against eavesdropping than Skype, but a phone call is synchronous: you can make the user apply the temporary password and choose his new password while he is talking to you. This may greatly reduce the window of vulnerability.

Answer 2

Obviously it is not ideal that users cannot change their passwords. But I take it that you have no capability to modify these applications; you need to operate what you have as securely as you can.

I do recommend you flag issues like this to your management, partly in the hope they will get the developers to make changes, and partly to pass on blame in case of issues. The ideal change to the application would be to ditch passwords entirely and integrate with a single sign-on environment, such as Active Directory.

One practical way of dealing with this problem is to break the password in half. Send the first half by email and the second half as a Skype instant message (or SMS, or whatever).

Answer 3

It really depends on the security you really need. For most webs and services it is ok to send you a clear password (or reset password link) to your e-mail. Nowadays the communication between e-mail servers and clients are encrypted (but the the e-mail can be read by anyone in the chain between the sender and the receiver unless encrypted).

It also will depend vastly on the context and the amount of information you give within the e-mail: if you send something like "your new password for the applications TheApp for your Username is Password" then you are giving a lot of hints (but this could be completely ok as well). Maybe you can send the password in a more subtle way...

What I will really do is always using the same channel so you can minimize the risks. As channels grows risks also grows so stick to a channel study its risks and try to ensure this method.

As another side note, I won't send the real password to the e-mail since any "observer" might find himself looking to the password by chance so I would rather send a link or a procedure for the user to get the new password when he is available to do so in a secure way.