I have completed my internship and my employer wants me send him my bank account details so that he can transfer me my stipend. How can I securely do this? I have Ubuntu MATE 16.04. My employer is not that tech savvy. He would be fine with emails and password protected zip file/google drive text file but telling him to set up pgp/gpg would be too much.
He would be fine with emails and password protected zip file/google drive text file
Firstly, you need to take into consideration the level of security you want vs practicality. In this case, you have mentioned that your employer is comfortable with emails and password protected zips. So, why not do that?
Without being overly complex, how you can do it is:
- Type your bank details in a text file and ZIP it up with encryption (you can use AES-256 bit encryption which I believe offers a good enough protection)
- Send your password to the ZIP file in a separate email
What I am proposing above protects the transmission of the file. Of course, if you decide that the email service cannot be trusted, there are many ways to make it more secure. You could further:
- Encrypt your ZIP file password with another key which is already known to your employer (e.g. your name)
- Skip step 2 and call your employer and tell him the password over the phone
- Send the password using another email service
To me, even if your bank account details (I supposed that is only your bank account number, bank name and your name) are exposed, there are no severe risks. There is no need to make it overly complex.
Why not send him by Email?
I might be missing something here but I believe that if you have a strong enough password and 2 factor authentication then using any of the big email providers that use HTTPS (Gmail, Outlook, Yahoo, etc..) should be perfectly fine and secure.
Either way it's not like someone can do much with your bank information. The following are possible attack vectors as I quoted from my answer in this question:
1) If I have a picture of your ID and your account information, I can edit the ID to have a picture of me and go to the bank with the fake ID and identify myself as you.
2) If I have your login details I can try to brute force online account and then manage your account as I wish.
Check out the rest of the answer here.
Your bank account details are private informations, but not secret ones. I still use bank checks, which contain those informations and have no problem with that. And it is common to exchange bank details with clients or providers through simple unencrypted mails.
The security level must be what is required by the risk. You should never publish bank details on Facebook or a public web site, but sending them by mail to a specific recipient is fine.
If you think that is deserves more security, you are on your own, provided your employer accepts it. IMHO, an encrypted zip file should be enough.