6

I'm currently a web developer for a company with lots of different remote clients. There are lots of usernames and passwords that I need to know so that I can do my job. When I first started, I was able to obtain a good chuck of credentials by reading them off my boss's computer. I stored them on my computer, in 1Password. However, as time went on, it became more convenient for my boss to email the credentials I didn't have, sometimes over https, sometimes not. Also, sometimes the clients themselves need to send me their login credentials, for example, so that I can access their hosting account.

It seems like I get new credentials fairly frequently. Some of the clients I work with aren't too computer savvy, few are. Are there any somewhat simple ways to improve security in this system? I doubt that most of my clients would know how to encrypt their credentials with their private keys. I've been working for this company for about 6 months now and already I've had to help a client clean up his site because it got hacked. Though, to be fair, I'm not sure how often our clients get hacked.

Is there something I can do to improve this system or are we just doomed?

Improve this question

2 Answers 2

Reset to default
6

First, you can't e-mail over HTTPS. HTTPS is a web site protocol, not an e-mail protocol. Encrypted e-mail exchanges require the mail servers to communicate using TLS or SSL. The best way to exchange credentials, if you absolutely have to do it, is to encrypt them with a secure, long password or better yet, a pre-shared key or using a secure key that is shared using asymmetric cryptography to prevent the key from being accessible to someone reading the e-mail.

Secure FTP is also another viable option if you have a secure FTP site that can be used. Again, high security passwords should be used.

SFTP is probably the simplest since you can install a fairly simple client to let them upload it with. Most e-mail encryption setups are going to be overly complicated for an average user unfortunately.

The ultimate easiest way would be to use some kind of HTTPS website that would allow them to submit the credentials and protect them with a random key that would be encrypted with a public key that only allows the credential key to be decrypted after the credentials are removed from the web connected machine.

Improve this answer
11
  • Perhaps the OP meant webmail over HTTPS?
    – Eric G
    Jul 25, 2013 at 3:53
  • @EricG - that was my guess too, but that doesn't actually provide any security to the e-mail itself. My point was that webmail isn't sending an e-mail, it's just a web based client that connects to the e-mail server, often over an unencrypted link.
    – AJ Henderson
    Jul 25, 2013 at 13:25
  • Wait, I have some doubts now. If I use Gmail over HTTPS, won't my email's content be encrypted on its way to the email server? Likewise when I check my email, won't it be sent to my computer over an encrypted link? Or am I misunderstanding what HTTPS does?
    – 425nesp
    Jul 25, 2013 at 20:30
  • @piña - Webmail is generally a web client for an e-mail service. Gmail may be different in that I don't know what they use as far as e-mail servers, but generally there is a webserver which hosts a webmail client and an e-mail server that handles actual delivery and storage of e-mail messages. E-mail servers communicate on different ports with different protocols than web traffic. HTTPS protects the web traffic portion of using a webmail client, but it does nothing to encrypt and protect the actual exchange between the webmail server and the mail server or between other mail servers.
    – AJ Henderson
    Jul 25, 2013 at 20:54
  • 1
    @piña - it's a minor detail, but technically, the web is the HTTP/S network while e-mail is another service on the Internet, so e-mail is an Internet protocol rather than a web one. That's why most websites start with "www." but most mail servers start with "mail.", "smpt.", "pop." or "imap." The beginning of a URL actually has to do with the service being provided on that URL as the highest level of the domain name and the http:// tells the URL that it is a hypertext transfer protocol that should be used to access the resource.
    – AJ Henderson
    Jul 27, 2013 at 3:28
3

I second the suggestion from AJ Henderson of some non-email, web-based, HTTPS messaging application that your clients can use.

In the absence of that, you could just change the password every time you are sent credentials insecurely, storing the new, strong password in your password manager.

You can take this opportunity to educate your clients: "I changed the password because it's not secure when more than one person knows it". They can then change it to something else after you're done.

Improve this answer
2
  • +1 on changing the credentials after they are sent insecurely
    – Eric G
    Jul 25, 2013 at 3:55
  • 1
    I'll change the passwords when I'm the only person that needs them, but often times, multiple people need to know the password. If I change it, then I'll need to update everyone in my group, which brings us back to the original problem.
    – 425nesp
    Jul 25, 2013 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.