1

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need to tell me it or I should change it and tell him. In any case, the password has to be send.

So far I've been using email, but I'm not sure whether this is an appropriate way. Web services usually send your password to your email, but also you are allowed to change the password. In this case, it's for intranet applications and in order to change the password, always someone else needs to know the password as well.

When the new account is for someone placed at my location, I just approach him and tell him his login information, but there are many locations within this intranet, so often approach the new user is impossible.

PS: colleagues were using Skype as well.

  • 2
    "can be considered insecure" ? Email's about as secure as writing on the back of a postcard. – Shadur Feb 6 '14 at 10:11
  • if two factor authentication is there mail might be ok. – Arun Killu Jun 22 '18 at 13:38
10

Email is insecure. Emails can be lost, misdirected, eavesdropped and faked. Sending a password by email is a big vulnerability.

"We" do it nonetheless because in some situations alternatives are just worse for usability reasons. And we apply mitigation measures:

  • The password is temporary and does not allow access directly; it only gives access to a "password change" interface, this time through some protected tunnel (HTTPS...).

  • If the temporary password has not been used within a small amount of time, it is deactivated, and an alarm is raised.

  • The temporary password is deactivated automatically after usage.

  • Users are trained to raise alarms when they fail to receive an expected password by email, or when they try to use it and find that it is already deactivated.

Using Skype messages to transmit the temporary password might be a better idea. Skype messages are less routinely eavesdropped by amateur attackers, because they are encrypted, making the spying harder (details are not published but that's still better than no encryption at all). On the other hand, there is suspicion that Skype messages are routinely inspected by some governmental agencies (of various governments) who were given some backdoor access. That way, you get to choose the kind of attacker who can spy on the temporary passwords...

Spelling out passwords by phone may be a good idea, too. Phone lines are no safer against eavesdropping than Skype, but a phone call is synchronous: you can make the user apply the temporary password and choose his new password while he is talking to you. This may greatly reduce the window of vulnerability.

  • I like this answer more than mine (since it goes a bit further) but I would like to point (if I may) that although e-mail is a big vulnerability for this task it might not be a big risk. – kiBytes Feb 5 '14 at 14:56
  • I think I'm going to use a "temporary look to the password". Send the password through Skype and after a couple of minutes remove the message. – yzT Feb 6 '14 at 11:30
1

Obviously it is not ideal that users cannot change their passwords. But I take it that you have no capability to modify these applications; you need to operate what you have as securely as you can.

I do recommend you flag issues like this to your management, partly in the hope they will get the developers to make changes, and partly to pass on blame in case of issues. The ideal change to the application would be to ditch passwords entirely and integrate with a single sign-on environment, such as Active Directory.

One practical way of dealing with this problem is to break the password in half. Send the first half by email and the second half as a Skype instant message (or SMS, or whatever).

-3

It really depends on the security you really need. For most webs and services it is ok to send you a clear password (or reset password link) to your e-mail. Nowadays the communication between e-mail servers and clients are encrypted (but the the e-mail can be read by anyone in the chain between the sender and the receiver unless encrypted).

It also will depend vastly on the context and the amount of information you give within the e-mail: if you send something like "your new password for the applications TheApp for your Username is Password" then you are giving a lot of hints (but this could be completely ok as well). Maybe you can send the password in a more subtle way...

What I will really do is always using the same channel so you can minimize the risks. As channels grows risks also grows so stick to a channel study its risks and try to ensure this method.

As another side note, I won't send the real password to the e-mail since any "observer" might find himself looking to the password by chance so I would rather send a link or a procedure for the user to get the new password when he is available to do so in a secure way.

  • Have you heard of plaintextoffenders.com/about ? – David Cary Feb 6 '14 at 5:46
  • I don't want to go for broke but this is not a "plaintextoffenders" scenario. Here he is speaking about a way to let users know the password they can't select or change. This is not an automatic process derived of storing a plaintext password (AFAIK). Also, consider reading my last paragraph. – kiBytes Feb 6 '14 at 6:45
  • I have talked about this answer in the DMZ and I would like to clarify that I don't want to empower people to follow my first paragraph. That would be a mistake. I just wanted to advise on specifics scenarios when "rebuilding" the system is just impossible due to business limitations. It is completely ok to downvote this question since it may be misleading. I won't edit it and I am sorry for not being able to express my thoughts clearly. – kiBytes Feb 6 '14 at 8:56
  • I'd normally not vote on this answer, but I have given you +1 because I don't think you deserve the down votes. – paj28 Feb 6 '14 at 11:17
  • Thanks for your support, but downvotes are fine as well, is a way to learn and a way to improve the way you answer =) – kiBytes Feb 6 '14 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.