what's a secure way to send passwords over the internet?
I'm looking for the best way to send passwords over the internet safely. Options I've looked at are PGP and encrypted RAR files. There are no real parameters other than getting from point a to point b over the internets without too much risk.
PGP or another asymmetric encryption method would sound like the way to go ..
- both sides must publish his/her public key
- sign your message with your own private key
- encrypt with the other's public key
- transmit the file
- only the other's private key can decrypt the message
- your public key can be used to validate the message
=> secure & private
Any mechanism that uses asymmetric keys (like SSL or PGP) is good. Basically, it means that you encrypt the data (password in your case) with other person's public key, and the only way to decrypt it is to have access to the private key (which only receiver does).
The only thing to worry about PGP is who do you trust, because spoofing can easily happen when people sign their own keys.
Read the web of trust section in the wikipedia entry for PGP for more info about that.
What about calling the recipient with Skype?
You should also make sure the receiver has to change the password before being able to use whatever service it's for - authenticating the change with the sent one-time-password. This will provide further protection against theft - and/or slightly better chances at discovering one if it required the thief to change it, leaving the true user with an access denied prompt ^^