I'm currently a web developer for a company with lots of different remote clients. There are lots of usernames and passwords that I need to know so that I can do my job. When I first started, I was able to obtain a good chuck of credentials by reading them off my boss's computer. I stored them on my computer, in 1Password. However, as time went on, it became more convenient for my boss to email the credentials I didn't have, sometimes over https, sometimes not. Also, sometimes the clients themselves need to send me their login credentials, for example, so that I can access their hosting account.
It seems like I get new credentials fairly frequently. Some of the clients I work with aren't too computer savvy, few are. Are there any somewhat simple ways to improve security in this system? I doubt that most of my clients would know how to encrypt their credentials with their private keys. I've been working for this company for about 6 months now and already I've had to help a client clean up his site because it got hacked. Though, to be fair, I'm not sure how often our clients get hacked.
Is there something I can do to improve this system or are we just doomed?