When sharing confidential documents, it's common to zip up and encrypt the files with a good password.

However, all too often the file is emailed as an attachment with the password in the body of the email. Therefore an attacker with access to the email has everything they need to access the files.

Some slightly more savvy users will send a separate email containing the password, but this is only marginally less insecure as it's not unreasonable to assume that the attacker will have access to all emails if they have access to one.

Some even savvier users will email the file, then phone the recipient to read the password out. However, this invariably results in a conversation along the lines of:

"OK, the password is 'H65TU'... no, all caps... yes 'HT65U' then an ampersand... the and symbol... no, the squiggly and... yeah... then 3N... no, not 3 of them, just number '3' then 'N'... yep... '\4J'. Backslash. No the other one. On the left of the keyboard. That's it. What do you mean it didn't work? Right try it again... 'HT5NU'...

...and so on, all within earshot of other colleagues in the vicinity.

So what's a secure yet painless and practical way of sharing a one-off password with an end user?

  • 2
    Text? It's an out of band method, which should go onto a device most people carry with them. Admittedly, they probably get their email on it too, but it's slightly better than emailing... – Matthew Apr 11 '16 at 16:04

This is a good opportunity to utilize a random passphrase system (like Diceware or XKCD 936). A series of words can be much easier to convey over the telephone and yet the passphrases still provide good protection against guessing or cracking.

The main obstacle for passphrase use tends to be if the software you're using expects shorter passwords and doesn't accept these longer strings. I know PGP self-decrypting archives work fine with passphrases, and I believe modern ZIP software does too.

| improve this answer | |
  • For the rare cases where long passphrases won't work, using the first letter of the easy-to-convey-over-the-phone phrase can be acceptable most of the time, making your technique valid – niilzon Apr 11 '16 at 16:31

As a very rough analogy, a lot of 2FA systems send a code by SMS. I hesitate to suggest this as an approach given that it's quite likely that the recipient will have both the email and the SMS on the same phone and not secure it properly.

Snail mail is presumably too slow.

You could of course split the password between an easy-to-speak part phoned through, and a random part by SMS, with the instructions provided in the email. This may be overkill as passworded zip files aren't all that secure anyway: The mechanism is known and they're by definition available for off-line attack, so dictionaries, rainbow tables and brute force are all possibilities.

| improve this answer | |
  • Whilst this is probably the most comprehensive way of doing things, in reality most users aren't going to go to such lengths just to share a Word doc with Sharon in Payroll. – Widor Apr 11 '16 at 16:20
  • @Widor I agree completely. I assumed an external contact (thus email leaving the company, though with email as a service that's not the distinction it used to be). – Chris H Apr 11 '16 at 18:01

Use a combination between a text file and a phone call:

Put the password in a plain text file, and then drop the text file into a password-protected zip file. (7zip is free and open-source). email them the encrypted .zip/.rar/.7z file and then call them with their username and the password for the zip file.

This prevents anyone from opening the zip file, and even if they did, it's only a password, which doesn't give you anything without any other information, like username and where to use it.

| improve this answer | |
  • 2
    Since OP is specifically looking for a way to share the password to a password-protected zip file, this simply adds a layer of indirection without actually solving the problem (sharing a password over the phone is too cumbersome). This reminds me of the subset of people at my company who email URLs by putting the URL into a .doc file and attaching that .doc file to the email. – user15392 Apr 11 '16 at 16:59
  • this is for non tech-savvy people who don't necessarily have much time (or patience) for something involved like PGP/GPG , it may not be the best option but I wanted to mention this in addition to the other answers – storm Apr 11 '16 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.