Mastodawn

Thanks for all the comments everyone!

I have decided to go for a self hosted instance of https://pwpush.com

Setup was very simple, and I can brand it, and i think it fits the bill perfectly 👍

Securely Send a Password | Password Pusher

Password Pusher is an application to securely send passwords over the web. Links to passwords expire after a certain number of views and/or time has passed.

morph Aug 15, 2023

@michael I can't imagine e2e encryption without the client installing an application on their device. 🤔

@morph true. But with HTTPS and self hosted, the risk will be very low.

morph Aug 15, 2023

@michael Simple to use would be an encrypted Nextcloud storage on your side. You give the clients access to a file (like etherpad) where they and you paste the needed information. They'd have to unlock it though. But they can do it in the browser.

Frank Verhoeven Aug 15, 2023

@michael Sending the first half of the pass phrase over whatsapp or whatever, the second half over SMS?

Matt Lehrer Aug 15, 2023

@michael is a cli tool like wormhole too complex? https://github.com/magic-wormhole/magic-wormhole

GitHub - magic-wormhole/magic-wormhole: get things from one computer to another, safely

get things from one computer to another, safely. Contribute to magic-wormhole/magic-wormhole development by creating an account on GitHub.

GitHub

@mattlehrer yes, i think so

Endareth Aug 15, 2023

@michael https://onetimesecret.com/ can be useful. Single use, time limited link.

Onetime Secret

Keep sensitive information out of your chat logs and email. Share a secret link that is available only one time.

@endareth thanks! seems similar to pwpush.com, suggested by someone else.

@michael I just have them email the details exc. the password. Then they text me the password.

@Steveb yeah, that’s what I’ve done so far.

I don’t particularly like it though…

@michael Seems the most secure method to me. No third party has all the info.

Remember, all those other systems... They're secure, until their hacked.

@Steveb true of email and text message as well though (both being notoriously insecure)

@michael But they are separate. That's the point.

Someone has to get the data from both mediums to gain access.

@Steveb yea, I know. The idea would still be for them to be separate: email me the username, the use the service to send the password, for example.

@michael Fair enough. Was just trying to give a free option that (IMO) works, and is as secure as anything else out there.

@Steveb fair enough. and i think it's a valid approach. I was just trying to explain why I'm moving way from it 👍

https://proton.me/support/password-protected-emails

Jester Aug 15, 2023

@michael Probably not a perfect solution but you could create an account with Protonmail and utilize their password protected feature. You would need to set up some sort of password with them and communicate that (maybe using 1Passwords sharing feature) but once they have that they can log in and reply to your email in a secure way that only you and they can access to share details. It can also be set to auto delete after a period of time to help ensure the data is not hanging around. They just need some sort of email account of their own.

How to send Password-protected Emails in Proton Mail | Proton

Proton Mail lets you easily send secure, end-to-end encrypted emails to non-Proton Mail email addresses using a password.

Proton

Panopticola Aug 15, 2023

@michael A good old phone call works best with technology limitations! Verbal transcription can be problematic with some clients, though, so obscurity as weak fallback security can work if you, say, conduct key context discussions in one format, e.g. email, and pass along the secret out of context, say SMS.

@Panopticola a phone call would work with weak passwords. But a random 32 character alphanumeric string with special characters? No thanks 😬