Password-Protected ZIP Files Should Be Abolished

The Information Processing Society of Japan ran a feature on this topic in their bulletin recently, and around the same time I had some back-and-forth with a certain major company involving the so-called – send a password-protected ZIP as .zi_ – follow up with the password in a later email process, which caused a bunch of trouble (nobody really uses email for this kind of thing anymore anyway), and the timing lined up with a general feeling of exhaustion at how much hassle it took just to receive a few kB of data.

Plenty of people have already written about why password-protected ZIPs are harmful, so this might feel a bit late to the party, but I want to lay it out simply enough that anyone can follow it.

Here’s the short version of why it’s pointless: anyone who can intercept that attachment must also be able to intercept the follow-up email with the password. That’s the end of the argument. Five seconds of thought is enough to see it. My second-grader could probably follow this.

If, by some coincidence, only one of the two emails happens to leak (say, due to a misdirected send), there is some effect. But that’s not a security measure in any meaningful sense. The workflow itself needs rethinking.

Now let me explain, as concisely as possible, why it’s actually harmful.

– It gets waved through virus checks A standard trick in password-protected ZIP operations is to rename the file extension from .zip to something like .zi_ or .a. When that happens, these attachments often sail past virus checkers. “Passed” doesn’t mean “no virus was found” — it means “we couldn’t tell, so absolutely do not open this file!!!” But people open it anyway. Because it’s from a business partner, right? And spoofing the sender address is basic-basics for anyone with malicious intent. So declaring “we send things as password-protected ZIPs” amounts to saying “we’re going to render your company’s security measures meaningless, sorry about that (teheperoro~).” I doubt the people doing this even realize that’s what they’re saying.

– Can’t be opened on mobile As mentioned above, password-protected ZIPs usually come with altered file extensions. That means in most cases mobile devices can’t decompress them, even if you know the password. Checking email on mobile while out and about generally helps today’s working professionals get more done. Undermining that on purpose is a contemptible move.

– It’s just depressing It makes you feel the harshness of the world. I can picture the scene: the company’s security staff figured out long ago that this is pointless, but they keep running it reluctantly anyway, saying things like “it’s hard to change a system that’s already in place” or “because the higher-ups said so.” It makes me feel the sheer irrationality of it all.

Next, let’s talk about why password-protected ZIPs are thought to be a good idea. Plenty of people have adopted them, so there must be some kernel of reasoning behind it.

For instance: – Having a “password entry” step keeps files from being opened carelessly The logic goes: this gives the recipient of a misdirected email a chance to think “huh? From so-and-so? What’s this file? Oh, it’s password-protected,” which buys time for a follow-up like “Sorry, I sent that by mistake. Please delete the earlier file!” To which I’d say: just be careful in the first place. Also, it’s rare to see an operation where “only special emails get password-protected” — in most cases, every single email gets turned into a password-protected ZIP. In that case, everyone just enters the password and opens the file without giving it much thought. There are plenty of other practical countermeasures against misdirected sends, so this is a weak justification for bothering with password-protected ZIPs.

For another example: – Sending the password through a separate channel makes it secure This part is true. But how many people are actually doing this? Some companies have adopted “automatic password-ZIP systems,” and naturally the password still gets sent in a follow-up email. Even if you skip such a system and create the password-protected ZIP yourself, then follow up with “the password is your company’s name,” anyone who’s already hacked their way in obviously knows that too. Something like “it’s your birthday” raises the bar a bit, but it’s not something that can’t be looked up (and besides, who knows the birthday of some random guy at a business partner anyway). And reading out something like “the password for that attachment is aXg2JGsGEsxhhjlesSO” over the phone is a pain from an operational standpoint. The only approach that seems remotely effective would be mailing each other a cipher table in advance, conveying the password according to that table, and changing the table irregularly. Sounds like something the FBI or MI6 might do? Ha. Also, offline password cracking can always be done given enough time and motivation. So taking issue with password-protected ZIPs themselves has almost no practical significance.

Also, this isn’t something I witnessed myself, but – there’s apparently a misunderstanding that “adopting password-protected ZIPs is mandatory” to obtain Japan’s Privacy Mark certification Apparently this case exists too. This is probably just a myth, by the way. I regularly exchange files with companies that have obtained the Privacy Mark, and I don’t recall password-protected ZIPs ever coming up.

I won’t answer the question “so if you take away our password-protected ZIP, our trump card, what are we supposed to do?” here. I’m not a security expert. I’ll leave that to the people who make their living at it. For anyone who wants to hear my personal take anyway, I’ll offer it separately, strictly as unofficial advice. Ha.

Originally published in Japanese at https://clazytech.com/2020/06/360/. Translated with LLM assistance and reviewed before publication.