Last week I received an email with a password-protected archive attached, and the password sitting in the second line of the message body. The sender even wrote the words password protected in bold, as if labeling it made it secure.

I don’t blame them personally; I’ve sent similar emails myself, years ago, with the same quiet contradiction involved. I’ve noticed this ritual pops up everywhere, half remembered and half eroded, and it tells you something interesting about how controls actually behave in the wild.

The Original Idea Was Sensible

To be fair, the practice made real sense when someone first wrote it into a policy. Splitting the archive and the password across two channels means a single compromised inbox doesn’t yield both the locked file and its key. If a mailbox gets phished or a mail relay gets inspected, an encrypted attachment without the password is just noise. That was a reasonable control, designed by people who understood the threat model of email fairly well.…