1
$\begingroup$

I'm creating a messaging application that will use an outlook account to send an email. However, I'm unsure about the proper steps to store the e-mail password on the user's computer. Suppose I had the following code:

SmtpClient SmtpServer = new SmtpClient("smtp.example.com");
var mail = new MailMessage();
mail.From = new MailAddress("you@example.com");
mail.To.Add("to@gmail.com");
mail.Subject = "Test Mail - 1";
mail.IsBodyHtml = true;
string htmlBody;
htmlBody = "Write some HTML code here";
mail.Body = htmlBody;
SmtpServer.Port = 587;
SmtpServer.UseDefaultCredentials = false;
SmtpServer.Credentials = new System.Net.NetworkCredential("you@example.com","pass");
SmtpServer.EnableSsl = true;
SmtpServer.Send(mail);

Obviously, I don't want "password" stored as a string inside my application. What would be the ideal/proper solution to storing a password on the user's machine so I can read it into my application, and pass it to the NetworkCredential constructor?

I've done reading here, and here. The first link suggest storing it in a file or registry, not sure how to store it in a registry. How would I properly store it in a file?


Clarification:
This may have been a bit unclear from the above, but I want to allow some person, for which I set up an Outlook account, to send mails to other persons. So one may interpret this in that way that the created account "belongs" to that person, but I also know the password - for administration purposes and the user may know it.

$\endgroup$
  • $\begingroup$ Does the password belong to the user of the application or to the developer of the application? $\endgroup$ – CodesInChaos Oct 14 '15 at 18:12
  • $\begingroup$ @CodesInChaos - Developer. The user other than this application has no access to the outlook account $\endgroup$ – Nexusfactor Oct 14 '15 at 18:14
  • 3
    $\begingroup$ In that case the answer is: Don't do that. There is no way to protect the password. $\endgroup$ – CodesInChaos Oct 14 '15 at 18:15
  • 4
    $\begingroup$ Probably calling a publicly accessible API point on your server. That API can enforce whatever restrictions you need. The server then sends the actual email. $\endgroup$ – CodesInChaos Oct 14 '15 at 18:16
  • 2
    $\begingroup$ You can't protect the password from the user who owns the computer your program is running on. KeePass does not attempt such a thing. Keepass only protects against the file being stolen. $\endgroup$ – CodesInChaos Oct 14 '15 at 18:19
1
$\begingroup$

I'm unsure about the proper steps to store the e-mail password on the user's computer.

There are two ways I would recommend (in tandem if possible).

First, some SMTP servers (like Google) allow you to create an Application Password. This password has limited access (for instance just for email) and can't be used to change the users password.

Secondly, use .Net's built in capability to encrypt the web.config/app.config. The nice part here is that the configuration sections can just be read by your application, it doesn't know they are encrypted or not, .Net takes care of it for you.

This may have been a bit unclear from the above, but I want to allow some person, for which I set up an Outlook account, to send mails to other persons

If the application is sending an email from the computer Outlook is installed on, you may want to consider How to open Outlook new mail window.

$\endgroup$
  • 1
    $\begingroup$ The second suggestion seems to have the problems mentioned in the comments under the question. The first could be a real solution, if app password permissions are granular enough. $\endgroup$ – otus May 11 '16 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.