I am a web developer who often takes over clients' current website. The clients often send me their CPanel password via email. I know this is bad, but I don't know a safe alternative.
This is what I've come up with...
I have created a 'credentials' form on my dedicated, SSL encrypted server which accepts ONLY the password (no reference to domain or username which I ask for over email)
The form posts the password to my php script which encrypts the password with aes-256-ctr and saves it to a write only directory below the server public dir. The filename will be the client's random, no sequential id number so I can then match it with the domain.
I then SCP the file to my machine and immediately delete it from the web server. No passwords will be kept on here.
I save the password in an encrypted password store on an encrypted USB stick.
I know fundamentally, because the password can be decrypted its not 100% secure, but it is critical that I am able to eventually read this password as plain text.
Can I do this better?