How can clients easily and securely send me passwords?

Question

I often need to get passwords from clients for FTP, SSH, MySQL, Authorize.net, etc.

What's an easy way for them to send me passwords securely? Maybe even without them needing a login/password?

Encrypted IM sessions are a hassle to set up with non-techies. Phone calls break up my concentration and require arranging. (Are VOIP calls secure, anyway?)

Ideal: An easy way for non-tech-savvy people to send encrypted email. PGP/GPG doesn't cut it, unless Outlook has some super-easy built-in wizard. (You never know...?)

Good: A web-based secure message system (hopefully in PHP) that I could host and run over SSL. I haven't been able to find anything like this.

Maybe I'm asking the wrong thing or the wrong way. Any suggestions are appreciated!

Answer 1

Your idea of a web-based messaging system could be implemented in a few dozen lines of HTML and PHP (mostly html) on any system that had an SSL web server and GPG installed. It’s really just a very simple but specialised formmail type program. You could even hack an existing formmail CGI script to insert a call to GPG (assuming one doesn’t already exist, try Googling for formmail + GPG)

• If you haven’t already done so, install gpg on your workstation and create your public & private keys
• Create a php page that displays a form to accept a message (text field), encrypts it with gpg using your public key, and emails it to you. Hard-code your email address in the script (i.E don’t allow the sender to specify who to send to)
• Install the php page on an existing ssl server or create one just for the task. A self-signed cert is good enough for this job.
• Tell your client the url when you need them to send you a login and password.

Btw, thunderbird has the Enigmail plugin which makes using GPG encryption very easy. But it’s still probably too much trouble for casual users.

Answer 2

PGP is popular.

You can also try the tried and true method of a meeting at a pond, preferably with both of you wearing trench coats.

Answer 3

This is a combination between a text file and a phone call:

Have your client put password in a plain text file, and then drop the text file into a password-protected zip file. (7zip is free and open-source). Have them email the encrypted .zip/.rar/.7z file to you and then call with their username and the password for the zip file.

This prevents anyone from opening the zip file, and even if they did, it's only a password, which doesn't give you anything without any other information, like username and where to use it.

Additionally, this is a way to email a "forbidden" file type, like a .exe, to an email client that scans attachments and inside zips. In those cases, I usually just include the password for the zipped file in the email, and it's usually "password". It's enough to stop email software from checking the contents, though.

Answer 4

Don't overcomplicate the matter, and don't overestimate the importance of what your client is sending you.

If either computer has a key logger running, no amount of encryption will protect those precious passwords.

I wouldn't send REALLY sensitive passwords across the internet (such as an administrator's password) but for the applications you mentioned? It's not worth the effort to secure them on the off chance that someone might be intercepting your emails.

If your client is concerned, they have several options:

1. Learn how to send encrypted emails.
2. Send a fax, if possible.
3. Snail mail? (lol)
4. Speak it clearly over the phone using a Phonetic Alphabet

Answer 5

What about Cryptocat? Secure, easy to use and a browser is all you need. For details see the About page.

As Ian Dunn has pointed out, the system has the flaw that an attacker could pretend to be your client. The only security in this case would be the name of the chat room that would then become the password. Problem shifted, but not solved.

However, I often need to sent clients 30+ char salad (we call them passwords) and I mostly I use crypto.cat to exchange the credentials while talking to them on the phone. This seems to be very secure for me and the client can use CTRL+C.

Answer 6

set up a Password Safe file in a shard Dropbox, so clients can add passwords as needed.

Joel describes the technique here

Answer 7

You might want to try NoteShred. It's a tool made pretty much for your exact need. You can create a secure note, send someone the link and password and have it "shred" it self after they read it. The note is gone and you get emailed a notification to let you know your info is destroyed.

Its free, and doesn't require any sign up.

https://www.noteshred.com

Answer 8

Skype's Instant Messaging is encrypted.

Now, here comes the necessary caveats: Skype is not open source so you don't know whether or not they did a terrible job or installed a government backdoor or copy all messages to Bob in IT, but the best available evidence suggests that it is secure.

Answer 9

How about in a text file on an encrypted USB key sent via snail mail

Answer 10

This process doesn't work in all situations, but I think it's good for multi-user systems (like a CMS or hosting control panel):

1. Client calls you on the phone.
2. While you're on the phone, the client logs in to the system and creates a new admin account specifically for you, rather than giving you access to their existing one.
3. They pick a relatively simple, random (but 15+ character) passphrase for the initial password (e.g., driving to portland this weekend or where are my headphones)
4. They tell you the passphrase over the phone.
5. You immediately login to the system and reset the password to something truly strong, e.g., #]t'x:}=o^_%Zs3T4[ &#FdzL@y>a26pR"B/cmjV.
6. You store the final password in your password manager.

The advantages to this approach are that:

1. It's relatively simple for the client. They only have to know how to create an account on the system. You can walk them through that while you're on the phone if they have trouble.
2. It's relatively simple for you also. You don't have to deal with setting up and sharing encrypted files, hosting a custom form application, etc.
3. It uses a passphrase (as opposed to a password) so that the temporary password is easy to communicate over the phone, but is also relatively secure.
4. The final password is never transmitted (except for the reset password form, of course, but that should be encrypted by the system).
5. The final password is never known by the client, so they can't accidentally expose it to attackers. Of course, they can still expose their own account's password, but a post-mortem investigation of an incident would trace the penetration to their account, not yours ;)

The initial passphrase is the weakest link in the chain because of its relatively low entropy, and insecure transmission over the phone. It still has ~100 bits of entropy, though, and it only lives for 15-90 seconds. In my opinion that's good enough unless you're working on something highly sensitive, or you know that you're currently being personally targeted by a good hacker.

Answer 11

Some people in this thread were suggesting to create a web application to do just that. In fact some even created their own. Frankly speaking I don't think its a good idea to rely on strangers for a service like that. I implemented a basic web application that enables users to exchange passwords via a simple web interface and made it available freely under the MIT license.

Check it out here: https://github.com/MichaelThessel/pwx

It takes minutes to set up within your own infrastructure and you can scrutinize the source code. I have been using my own install with my clients for months and even the non-techy folks picked it up in no time at all.

In case you want to test the application without installing it first, you can have a look here:

https://pwx.michaelthessel.com

Answer 12

How about sending the passwords via good old SMS? It's very simple and, as long as you don't provide any other information in the text, it will be very hard to figure out where it goes.

Answer 13

This one is a bit more effort but saves the client time as well:

Set them up with something like Roboform but store the data on the web so that you can access it. When they log in somewhere RF will save the password and it's available to you.

Downsides:
*Not sure how secure online storage of Roboform is * You then have access to all of the client's passwords and they may not like that idea.

Answer 14

Using outlook or thunderbird with S/MIME is easy but even better is to have them call you and read you their password - if you want to be super awesome have them read part of it to you and then text you part of it and email you another part of it.

Answer 15

If the usage is very temporary, like one-time troubleshooting or file transfer, this level of security may be unnecessary. Have the client temporarily change the password to something you know, do your work, then have the client change it again. Even if the temporary password was discovered, it will be obsolete before it can be used for nefarious purposes.

Answer 16

A friend of mine created this website specifically for this reason: https://pwshare.com

For me and my friends in the hosting world, a great tool to quickly send passwords to clients.

From the about page: https://pwshare.com/about PWShare uses a public/private key encryption specification known as RSA. When the client wants to send a password, a public key is requested from the server.

The client then encrypts the password before sending the password to the server. Because of this, the server doesnt know or store the decrypted password.

Only using the link, which contains the Private key identifier and password, can the password be decrypted.

Answer 17

I would recomend using something like axcrypt. It is very intuitive so even technically challenged people can make it work.

Download AxCrypt here

When you use AxCrypt you or whoever you are dealing with can create a file with all of the passwords/sensitive info and then encrypt it with a passphrase. I always recommend at a minimum exchanging the pass phrase over the phone or in person (This is the best option). AxCrypt uses some decent encryption, so you can be sure it will keep all but the most determined adversary out. The best part with AxCrypt is that it integrates into windows as an explorer extension. In windows explorer all you need to do is right click on the file to encrypt it/decrypt it/

Happy Hunting!