I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.
I've thought of some options, but there are drawbacks to all:
- Email: insecure and travels in the clear, unless it is kept internal to the company. However, some mail is forwarded outside the company, and some user access from the Internet is no doubt done with unencrypted access. In any case, not all have email access (e.g., contractors).
- "Briefcase": I could add the password to the user's Zimbra briefcase, but this suffers from most of the same problems as email.
- Telephone: Problem with using the phone is that VoIP can be tapped and is, I believe, generally unencrypted (though I don't know). It is also possible that the recipient is using VoIP and whether it is encrypted or not is unknown - in fact, the very nature of the receiving phone is unknown. In any case, some user's are in a time zone 12 hours off from ours - so this is out for the most part.
- Encrypted Email: I hesitate with this one as it includes user education, but it may be the best way. Also, it means handing out keys somehow. There is also the email client support issue: users mostly use Outlook, but there are users using Gmail, Hotmail, Evolution, iPhone Mail, Apple Mail, and the Zimbra web interface, among others.
- Web Portal: With this, users could access a web page inside the company or over an encrypted link and get a password (or perhaps, request one as well). I'd have to set this up (not a problem: I'm a programmer and administrator in one...) but it still requires handing out a password for the VPN or to log in the first time.
Here are the problems that have to be overcome, in a nutshell:
- User education
- Unencrypted traffic
- User access
- User timezone differences
- User location differences
My inclination is that I'll probably wind up with some form of encrypted email and/or web portal; for now I'm using a mobile phone.
EDIT: The big problem here (as in all encryption methods) is in getting the initial password or key to the source. In particular, there needs to be a way to identify the originator and to prevent disclosure of the key. The problems we face in preventing disclosure are the following:
- User workstations are not all on central network
- Some users are isolated (work at home, etc.)
- Some users are international: 12-hour time difference
- Many users are not even employees, but contractors with sister companies or with outside vendors
I wonder if I'm just going to have to accept some risk.