Alice: I need the file
Bob: Sure, and I want to encrypt it first. Please put the strong PGP symmetric key with the copy&paste method to https://onetimesecret.com/ and send me the link.
Alice. Done, the URL is xxxxxxxx
Bob: Very funny, the link is empty.
Alice: I know, it was only a test if i can trust you ... Here the correct one, xxxxxxxx
Bob: Thank you very much. Did you have seen in the last Big Brother UK episode, the scene with the haircut?
Alice: I have what?
Bob: Malika has used a clipper in a comfortable way ...
Bob: Forget it, here the e-mail attachment, strongly encrypted with the AES128 algorithm. Have fun.
Alice: Thanks, too. You're welcome. Bye
Alice and Bob have used a service between them to exchange a password. The first look is, that they have done all right. But they have to trust the website onetimesecret. If the attacker owns the website, he knows the PGP symmetric key too. What is the better alternative to exchange a key?