A phone call is usually not recorded for indefinite history, whereas an email is usually not deleted. The transport security of either depends on a lot of things (phone: was it a landline, 2G/3G/4G, VoIP; email: does SMTP use TLS, does the client use TLS, etc.)

@DeerSpotter I'm not sure I follow that metaphor; typing something into an HTTPS web page is not the same security as typing it into an email.

@MikeOunsworth:all the emails i've sent the past few years were from https; gmail, owa, etc...

And when you receive the password over the phone what do you do...? Write it on a Post-It and stick it to the side of your monitor?!

@MrWhite I don't really understand the point of your comment...? I add it to my password manager.

@dandavis Just because your connection to gmail or whatever is secure does not mean the message will be encrypted all the way to the destination. superuser.com/questions/260002/…

@MrWhite At least you need physical access to read a Post-It note and not malware.

Do you call them or do they call you? If they call you then there is a slight benefit.

hmmmm, a policy which requires an an admin to know other peoples' passwords.

as mentioned in an answer, emails are stored somewhere. to overcome that, they could send the passwork using viacry.pt. you create a message that after accessed once, ceases to exist.

@nasch: If both endpoints are accessed via HTTPS the only vector could be along the trunk, which hackers don't have access to (3-letters might). If it's from say gmail to gmail, then it's encrypted the whole time.

@dandavis Regardless of what hackers do and do not have access to, if it isn't encrypted in transit, and it might not be, then you don't know what any hop along the way is doing with the message. It could be logged in clear text in a data store with inadequate security.

@nasch: which major webmail providers route emails in the clear as you describe?

@dandavis I never claimed any do. If you're in a situation where you're familiar with the practices of both your provider and the recipient's and you know it's encrypted end to end, then no problem. If not, then SMTP does not require encryption and it's best to assume it is not secure.

Proper answer is of course that IT shouldn't be setting or knowing your password at all. There should be a secure interface for you to enter a new one yourself, which is then hashed (with salt) and the hash and salt stored.

@luizfzs That's a neat little website, I've never seen that before. Seems like a good idea, also an idea that would be pretty easy to create.

A small detail: Will they communicate the password over any phone or do they require that you seat at your desk and use the internal phone system?

@Relaxed I’m actually a remote contractor so I don’t have a desk. They contact me via my cell phone.

Wait, why are they required to be in the password generation process at all? Why don't you pick it yourself subject to some automated guidelines? I started doing business with a company once that required me to call in to get a PIN to access their web site and that was a major factor in my decision to not do business with them after all! Unless it was a temporary password that I could change shortly after, I would balk at someone else even knowing my password.

@Michael in another comment I made I explain that this particular system has no end-user password management at all. Obviously that's bad, but at the same time my VPN account only grants me access to one tiny server that runs a single web app built by me. So in fact it's negligible security impact for me since they already have direct access to the system. For other contractors... well who knows, I don't know what they do!

@dandavis In 2015, "Google said that 57 percent of messages that users on other email providers send to Gmail are encrypted, while 81 percent of outgoing messages from Gmail are, too." Those are abysmally low numbers. And that's not even taking into account clients that may not be using https, or secure storage.

Tell them to setup a service where you can select the new password... (or maybe just login with theold password, click a "generate new random password" and save that in your password manager).