Return to Answer

No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.

There are some other security considerations to think about.

1. If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.

2. The email itself should be sent encrypted.

Avoid using SSL and early version TLS as the encryption method as these are longer considered secure. AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)

3. Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.

   A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.

Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.

The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>

Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.

Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.

Finally, you can mask the data when displayed for extra security.

No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.

There are some other security considerations to think about.

1. If your company has the robust technology to support it, passwords should be hashed using a strong algorithm such as bcrypt. Insecure protocols such as MD5 and SHA 1 should never be used.

2. The email itself should be sent encrypted.

Avoid using SSL and early version TLS as the encryption method as these are longer considered secure. AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys). When encrypting, choose a long key length to maximize security as the security of the key is directly correlated with its character length.

3. Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.

A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.

Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.

The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>

Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.

Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.

Finally, you can mask the data when displayed for extra security.

No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.

There are some other security considerations to think about.

1. If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.

2. The email itself should be sent encrypted.

Avoid using SSL and early version TLS as the encryption method as these are longer considered secure. AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)

3. Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.

   A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.

Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.

The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>

Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.

Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.

Finally, you can mask the data when displayed for extra security.

No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.

There are some other security considerations to think about.

1. If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.

2. The email itself should be sent encrypted.

Avoid using SSL and early version TLS as the encryption method as these are longer considered secure. AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)

3. Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.

   A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.

Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.

The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>

Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.

Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.

Finally, you can mask the data when displayed for extra security.

No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.

There are some other security considerations to think about.

1. If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.

2. The email itself should be sent encrypted.

Avoid using SSL and early version TLS as the encryption method as these are longer considered secure. AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)

3. Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.

   A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.

   The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message.

Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.

Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.

Finally, you can mask the data when displayed for extra security.

No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.

There are some other security considerations to think about.

1. If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.

2. The email itself should be sent encrypted.

Avoid using SSL and early version TLS as the encryption method as these are longer considered secure. AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)

3. Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.

   A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.

Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.

The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>

Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.

Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.

Finally, you can mask the data when displayed for extra security.