I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing both in one email?

  • No law I'm aware of, except those that might enforce policies on some particular organizations which forbid sending passwords via e-mail at all. In any case, passwords should not be sent via cleartext e-mail. – Iszi Jan 16 '13 at 19:29
  • Things get more interesting if you're subject to regulation (SOX etc) where internal controls may require it. – halfbit Jan 16 '13 at 19:48
  • Even if there is no law against it, it's a BAD idea. stackoverflow.com/questions/1069722/… – David Stratton Jan 16 '13 at 20:27
  • Best practice? minimal practice! Private keys and password have to not travel on public internet roads! No laws, but many enterprises conditions (mostly by signed contracts). – F. Hauri Jan 17 '13 at 1:10
  • There is the law of common sense. Sending a password over an insecure communication channel is a violation of common sense. – Zoredache Jan 17 '13 at 20:22

If there is, it would be industry-specific. For example, the laws regulating nuclear reactors may be different from the ones regulating flower shops. As far as I know, there is no general federal law in the United States prohibiting you from sending credentials over email, even in the same message.

  • There are very few federal laws dealing with content within an email. Of course doing what the author is asking is a horrible idea. – Ramhound Jan 17 '13 at 17:17

Personally, any system that requires a password from an end-user should have a method of setting/re-setting that password without the need to send anything to the user, such as the user selecting a password upon registration, and then being able to reset and choose another password, preferably by confirming other details that were setup during registration such as secret questions etc. This would ensure that if someone wanted to get at the password, they would either need to compromise the system (hash/salt anyone?) or compromise the users machine or network.


No - there is no law against it, but sending the two at once effectively gives the recipient of that email, or anyone who intercepts it, access.

By separating them, an attacker will need to intercept two messages, and if the two are sent by different media (eg an email and an SMS message) the attacker has an even more difficult task.

  • 1
    I would point out that sending two emails to and from the same address is no better than sending one email, since if one is intercepted, the other almost certainly will be as well. Using two different channels of communication (e.g. email and IM, email and phone, SMS and IM) is much harder to intercept. – tylerl Jan 17 '13 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.