I have heard from different people and in different places that if I send an encrypted file to someone else, I should send them the password in a separate email; but why? If someone is sniffing, they will capture both and if the inbox is compromised, they will capture both. But apparently, it's "best practice" to send it separately.

Now personally, I would send a password via other means, such as a phone call. What would you guys recommend?

There is added noise to the channel if you send them separately, assuming there is a delay in sending the second email the attacker would have to listen for a longer period of time and filter more content. It is simply a little bit safer than sending everything in the same package, think of ordering a safe box and shipping the keys along with it, its basically the same idea.

You are right in thinking that sending the password via a different channel (sms, phone, etc) is more secure, however it also requires more management and collection of more information, the logistics of doing it come with an added cost.
