I always am disturbed by seeing requests or hearing when users want to send a username and password via email. After trying to find research on this topic, I’m starting to question whether or not I’m being too paranoid. So I wanted to ask the community how they feel about this topic. I believe people should not send usernames and password in email at all. In my mind, its always best to make the phone call…leave a vm if needed. This prevents unknown persons from sniffing the network traffic and finding their password. But then again, I’d bet the business folk would argue, “what’s the data you are trying to protect?”