Don't send passwords, API keys and other sensitive information using email

In today's interconnected world, the secure exchange of sensitive information is of paramount importance. However, one common and potentially hazardous practice persists: sending sensitive data, such as passwords, API keys, and other confidential information, via email.

This article explores the risks associated with this practice and highlights the potential consequences of such actions. By understanding these risks, individuals and organisations can make informed decisions to protect their data and ensure the security of their systems.

Email was not originally designed to be a secure communication channel. It lacks the robust security measures required to safeguard sensitive information adequately. Here are some key vulnerabilities associated with email:

Lack of encryption:
By default, most email services transmit messages and attachments in plain text, making them susceptible to interception. Without encryption, unauthorised individuals can easily access and exploit the information contained within these communications.

Data leakage:
Email servers and the email transmission infrastructure can be compromised, leading to data breaches. Attackers can gain unauthorised access to email accounts or intercept messages during transit, potentially exposing sensitive information to malicious actors.

Phishing and social engineering attacks:
Email is a prime target for phishing attempts, where attackers impersonate trusted entities to trick recipients into revealing sensitive information. Sending passwords or API keys via email increases the risk of falling victim to such attacks, leading to account compromise or unauthorised access to systems.

An API key is a unique identifier that grants access to an application programming interface (API). It serves as a secret token that authenticates and authorises API requests made by developers or applications, i.e. between a payment gateway and your website.

API keys are typically used to regulate access, monitor usage, and enforce security measures for APIs. They allow developers to integrate third-party services, retrieve data, interact with cloud services, and perform various actions within the boundaries defined by the API provider. API keys enable controlled access to APIs while ensuring accountability, tracking usage, and safeguarding sensitive information.

Unauthorised access:
If sensitive information, such as passwords or API keys, is intercepted, unauthorised individuals can gain access to critical systems or accounts. This could result in data breaches, financial loss, reputation damage, or even legal consequences.

Account compromise:
When passwords or API keys are sent via email, they are stored in email inboxes or archives, which may not have adequate security measures. If an attacker gains access to an email account, they can easily obtain sensitive information and compromise associated accounts or systems.

Regulatory non-compliance:
Many industries have specific regulations and compliance requirements, such as the General Data Protection Regulation (GDPR) or the Health Insurance Portability and Accountability Act (HIPAA). Sending sensitive information via email without proper security controls can result in violations of these regulations, leading to penalties, legal action, or loss of customer trust.

Reputational damage:
A data breach resulting from sending sensitive information via email can have severe consequences for an individual or an organisation's reputation. Trust is crucial, and a breach can lead to diminished credibility, loss of business opportunities, and damaged relationships with customers, partners, or stakeholders.

To mitigate the risks associated with sending sensitive information, it is essential to adopt secure alternatives. Consider the following best practices:

Encryption:
Utilise encryption technologies such as Transport Layer Security (TLS) to protect data in transit. Encourage recipients to use encrypted email services or secure messaging platforms that support end-to-end encryption.

Secure file transfer:
For sensitive files or documents, use secure file transfer services that employ encryption and provide password protection for the files. Share the password separately from the email, ideally through a different communication channel.

Two-factor authentication:
Enable and encourage the use of two-factor authentication (2FA) for all accounts that store or provide access to sensitive information. 2FA adds an extra layer of security by requiring an additional verification step beyond the password.

Secure collaboration platforms:
Invest in secure collaboration platforms that offer enhanced security measures, such as access controls, encryption, and audit trails. These platforms allow secure sharing and collaboration on sensitive information without resorting to email.

Education and awareness:
Regularly educate employees, clients, and partners about the risks associated with sending sensitive information via email. Promote strong password practices, awareness of phishing attacks, and the use of secure communication methods.

Password Manager:
Use a password manager, eg Bitwarden, LastPass, 1Password; these allow securely sending and also sharing passwords between users.

A password manager is a secure, encrypted vault that stores and organises all your passwords in one place. Instead of relying on your memory or resorting to using weak, easily guessable passwords, a password manager generates strong, unique passwords for each of your accounts. It takes the burden of remembering and managing passwords off your shoulders, freeing up valuable mental space.

Use a one time secret system:
Like the one we host here: https://secret.modd.com.au/,

You're welcome to use it for creating your own secret generator. This ensures only 1 person can access the secret, and after that, it is destroyed. (Please only use those offered by reputable companies).

One-time secret generators are tools or systems that generate unique, time-limited passwords or codes for secure communication or access. These generators offer an extra layer of protection by ensuring that each secret is only valid for a single use or a limited period, greatly reducing the risk of unauthorised access or exposure.

By using a one-time secret generator, you can enhance the security of sensitive information, such as login credentials or confidential data, by preventing unauthorised individuals from gaining long-term access. Whether for secure file sharing, password recovery, or temporary access authorisation, one-time secret generators provide an invaluable solution for safeguarding your digital assets.

Store passwords in a notebook offline:
Storing your passwords in an offline notebook provides a simple yet effective way to protect your sensitive information. By keeping your passwords physically separate from the digital realm, you minimise the risk of online hacks or data breaches. Take control of your security with the reliability of pen and paper. Write your passwords in a notebook or diary completely offline and then make sure you store this in a safe place.

Also avoid:

Avoid the practice of storing passwords in easily compromised text files, word documents, or Excel files on your computer. Malware can easily access and steal such files, and it's tempting to consolidate multiple passwords in one place, increasing the potential impact if the file is compromised. Safeguard your passwords by adopting more secure storage methods.

The risks of sending sensitive information, such as passwords, API keys, or confidential data, via email are substantial. Email's inherent vulnerabilities make it an inadequate channel for secure communication.

It is crucial to recognise these risks and adopt alternative methods to protect sensitive information effectively. By prioritising encryption, leveraging secure file transfer services, and promoting awareness of secure practices, individuals and organisations can mitigate the potential consequences of sending sensitive data via email. Safeguarding sensitive information is a shared responsibility, and by embracing secure alternatives, we can better protect our data and preserve the trust of our customers and partners in the digital age.