When sharing confidential documents, it's common to zip up and encrypt the files with a good password.
However, all too often the file is emailed as an attachment with the password in the body of the email. Therefore an attacker with access to the email has everything they need to access the files.
Some slightly more savvy users will send a separate email containing the password, but this is only marginally less insecure as it's not unreasonable to assume that the attacker will have access to all emails if they have access to one.
Some even savvier users will email the file, then phone the recipient to read the password out. However, this invariably results in a conversation along the lines of:
"OK, the password is 'H65TU'... no, all caps... yes 'HT65U' then an ampersand... the and symbol... no, the squiggly and... yeah... then 3N... no, not 3 of them, just number '3' then 'N'... yep... '\4J'. Backslash. No the other one. On the left of the keyboard. That's it. What do you mean it didn't work? Right try it again... 'HT5NU'...
...and so on, all within earshot of other colleagues in the vicinity.
So what's a secure yet painless and practical way of sharing a one-off password with an end user?