In a remote-first world, sharing access is a daily necessity. "Hey, what's the login for the staging server?" "Can you send me the API key for Stripe?" "I need the password for the corporate Twitter account."
The path of least resistance is to send it over Slack or Microsoft Teams. This is a security nightmare.
Why Chat For Credentials is Bad
- Retention Policies: Many companies retain chat logs for compliance. That password you sent is now archived forever.
- Notification Previews: "Here is the password:
Hunter2!" often pops up on lock screens or unauthorized devices. - Searchability: If an attacker gains access to your Slack workspace, the first thing they do is search for "password", "login", or "key". You've just given them the keys to the kingdom.
The Good Way: Password Managers
The best way to share passwords is using the "Sharing" feature of a business password manager like 1Password or Bitwarden.
- Pros: Secure, auditable, revocable.
- Cons: Requires both parties to have the same software and valid accounts.
The Flexible Way: One-Time Secrets (NopeNotes)
Sometimes you need to share a secret with a contractor, a client, or a temporary employee who isn't in your password manager vault.
This is the perfect use case for NopeNotes.
The Workflow
- Type the secret (password, API key, config string) into NopeNotes.
- Get the link.
- Share the link via Slack/Email.
- The recipient clicks it. They copy the secret.
- The note destroys itself.
Now, if an attacker searches your Slack history in 6 months, they find a dead link. The secret is gone. The trail is cold.
Best Practices for Remote Sharing
- Never put the password and the username in the same message. Send the username in chat, send the password via NopeNote.
- Verify receipt. Make sure the person opened it.
- Rotate credentials if you suspect a leak.
Security doesn't have to slow you down. It just requires better habits.
