I know that a password for an encrypted file distributed by email should be sent out of band (i.e. not via email), and that there are better options for distributing information securely.
But, let's say someone ignores this advice and uses email for both, albeit in separate emails separated by some arbitrary time delay.
Assuming that hosted email services are used i.e both source and destination email servers are in 'the cloud' and we only consider the risk of observation of the emails as they travel across the Internet (between the sender's domain and the recipient's domain).
My initial thought is that it should be assumed that the encrypted file has been compromised, but upon reflection I don't know enough about Internet routing protocols in practice to decide whether their dyanmic nature is a factor for consideration or not.
So the question is: does the way routing protocols work mean that it is possible to come up with a likelihood that the two emails will follow the same route across the Internet and thus both be susceptible to unauthorised observation at the same point?