Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and password into separate channels under the assumption that it would be very unlikely that an eavesdropper would be sniffing both.
Is this a standard security practice, or something they just made up?
it's fairly standard to separate the username and password into multiple instances or (better) multiple forms of communication. Some send two separate emails (lol), some send an email and a phone call for the password, you'll find all sorts of methods for separating these. But a couple things should be kept in mind.
1) any password written anywhere or sent via any method in plaintext should be assumed compromised. 2) you can help mitigate #1 by sending a temporary password, requiring the user change it on first login, else expiring in 24 hours or such
while I would follow common sense while conveying passwords, I think the end user is the highest point of risk, not the act of getting it to them.
FWIW, I've seen more than one phone company print sms msgs on the bill.... at least skype should be an ssl connection.
Yes, it is a standard practice for the basic reason you described. However if the username is sent via email and the password via skype or some other messenger then all the attacker has to do is listen on your network port for the connection to the mail server and messenger service.
You then run into problems though if the password is saved somewhere in cache or the user doesn't delete the SMS message. It's not nearly as big a problem if it's a one time password though.
Separating the communication channels is a good idea, but using SMS for the password, not so much. I'd rather send the username by SMS, and the password over encrypted e-mail.
It's not really a good idea to text long-term passwords, because you don't know which carriers will transport your text and how. This StackExchange question explains the standard procedure for SMS encryption but you should remember that this whole infrastructure is not in your hands; it's better to have your own encryption.
Whenever you send a credential that must last over time, you need to do so with end-to-end encryption. After all, you might not be in front of your PC when you receive the password, and if it's intercepted someone may be able to log in before you do so and set another password.
You should only text one-time passwords, and only when you're confident the device you're sending it to is in your recipient's hands. It's a bad idea to lock someone out of an account just because their phone was stolen, especially as half of all smartphone users don't protect their device with even a PIN or a gesture.
So, password texting is good as one among multiple forms of 2-Factor Authentication with one-time passwords (ideally, provide an alternative for people with stolen phones), but not for sending lost passwords or password reset links.
