Last week I received an email with a password-protected archive attached, and the password sitting in the second line of the message body. The sender even wrote the words password protected in bold, as if labeling it made it secure.
I don’t blame them personally; I’ve sent similar emails myself, years ago, with the same quiet contradiction involved. I’ve noticed this ritual pops up everywhere, half remembered and half eroded, and it tells you something interesting about how controls actually behave in the wild.
The Original Idea Was Sensible
To be fair, the practice made real sense when someone first wrote it into a policy. Splitting the archive and the password across two channels means a single compromised inbox doesn’t yield both the locked file and its key. If a mailbox gets phished or a mail relay gets inspected, an encrypted attachment without the password is just noise. That was a reasonable control, designed by people who understood the threat model of email fairly well. I want to be clear that I’m not mocking the original intent, because the intent holds up even now.
The trouble is that the control only works while the two-channel part survives. The moment both halves travel together, you haven’t added encryption so much as added a step. You get the inconvenience of a password with none of the protection, which is arguably the least efficient trade in all of security. And yet this hybrid state is exactly where most real-world implementations end up, across plenty of organizations I’ve touched.
How the Ritual Slowly Erodes
The erosion follows a script I could recite in my sleep. Somebody sends the archive, forgets to send the second email, and the recipient chases the password for a day. The next time, they send both together to save everyone the hassle, and nobody pushes back because the file was probably not that sensitive anyway. Then that becomes the local habit, quoted in reply chains where the password keeps getting re-pasted by four different people. Six months later the password travels with the file every time, and the policy document still describes two channels with a straight face.
What’s interesting to me is that this isn’t a decision failure in any classic sense. Nobody sat down and voted to weaken the control; convenience just ate it one deadline at a time. The same dynamic shows up whenever a control demands ongoing human coordination that nobody actually owns. Teams end up stitching together email, archives, passwords, chat messages, and the occasional cloud link, each workaround invented locally and none of them written down. I’ve also seen unified platforms such as Ping64 used to cut down the overhead of juggling many separate security tools. The relevance here is that every improvised handoff is another place where a good idea quietly leaks, and fewer moving parts means fewer places for the two-channel rule to die.
It’s also worth noticing how the ritual survives on paperwork long after it dies in practice. Our own policy still says two channels, and I suspect it will keep saying that in writing for years, because rewriting policies is nobody’s favorite afternoon. The audit trail and the daily reality had drifted apart without anyone noticing, which is the classic pattern in my experience. Controls rarely break loudly; they drift quietly, and you only catch the drift when you happen to be on the receiving end of it, as I was last week.
What Actually Works in Practice
Agree upfront on the channel split, so the sender isn’t inventing one per file at deadline time. A password manager with a one-time share link covers the second channel without a second email, which removes the friction that caused the erosion in the first place. Use a fresh password per archive rather than the same family password everyone already knows from the last project.
Beyond the mechanics, ask whether email is even the right transport for something sensitive. If a file genuinely matters, a proper sharing system with access controls beats any amount of password theater around an attachment. And when you spot the same-email pattern in a reply chain, mention it gently rather than filing a lecture; people respond better to a nudge than to a policy citation they can’t read anyway.
Closing Thought
I replied to that email politely, asked for the password through our chat tool, and moved on with my day. The sender wasn’t careless; the system around them had simply eroded into a habit. That’s the more useful frame for this whole topic, honestly, because blaming individuals has never once fixed an eroded control in my experience. Controls are like buildings; they need maintenance, or nature takes them back one shortcut at a time. If your organization still describes two channels in its policy, it may be worth checking which channel actually survived contact with real deadlines. Mine, last week, was the chat window where the password now lives.
References
https://csrc.nist.gov/pubs/sp/800/63/3/final
https://attack.mitre.org/techniques/T1552/001/
https://www.cisa.gov/secure-our-world
https://www.enisa.europa.eu/publications
Top comments (0)