1

I use KeePass to store my passwords and it works great. From time to time, I create users in the network and I need to send them their initial password, which I generate through KeePass.

I usually send their passwords through email in a 7zip encrypted file with a master password. The problem is that I create a text file on the hard drive, containing their KeePass-generated password. Then I 7zip that text file encrypting with the master password and send through e-mail. That way I need to always remember to delete the text file (and the 7z file) manually. Not to mention, they are not overwritten instantly.

I wanted to be able to generate the 7zip encrypted file on the fly inside Keepass. Does anyone know of a way to do that? I searched KeePass plugins and didn´t find anything like that. Also I saw there is a plugin for secure exchange but it seems to be based on Outlook and that doesn´t help me.

Improve this question
1
  • 2
    How does the user know the master password? If you have a secure method for that, why not just use it for the real password?
    – Jeff
    Mar 30, 2017 at 18:31

2 Answers 2

Reset to default
1

If you can't follow @stephane's advice, why not send them the password in a KeePass DB, and contact them by phone with the password to that?

Improve this answer
0
5

The usual way to handle this is to set a random password, force a password change at first connection and send that password to the user.

More sophisticated systems will force the first logon and password change to happen within a limited period of time before disabling the account.

If you can use encryption (S/MIME or PGP) then all the better. If you can't, you'll have to accept the initial period of vulnerability.

if you intend to keep the user's password, then you have a problem: your procedure is insecure (because you still have the user's password in reversible encrypted format) and you should spend energy on fixing that instead.

Finally, if you really need to send secure information to the user then you will need some kind of initial secure channel and some way to perform encryption.

For instance, the system I'm working on creates a PGP key for the user (on his system) and uploads it to our server after we provided the user with a session key. We then use that key to encrypt all sensitive data we send to this user with his key. The session key is typically sent via registered snail mail or, in some cases, sent over the phone. We keep the (public) keys users send us for future communication.

Improve this answer
3
  • Thank you for the answer @stephane. In fact it´s an initial password because the first time the user logs in they will have to change it. I can´t use S/MIME or PGP around here. I understand I would have a initial period of vulnerability, except that I manually encrypt the initial password (using 7zip encryption). I would want to automate the process or at least get rid of creating files containing cleartext passwords before finally encrypting it.
    – Adriano_epifas
    Mar 30, 2017 at 17:35
  • You can also reduce the (temporary) value of the plaintext password by sending it in multiple pieces - half to the workstation and half to their phone, etc.
    – Royce Williams
    Mar 30, 2017 at 17:48
  • @Adriano_epifas In the end, it's always the same problem: you need a secure channel for initiating the connection. Human aren't really good at performing DH manually so, usually, you accept the initial window of vulnerability.
    – Stephane
    Mar 31, 2017 at 7:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .