Mixing
Safe storing passwords for user's mailbox
I know there are dozens of topics about storing a passwords in DB, but all of them are missing one approach: what if I want to use this password to authenticate my app to an external service?
Today I'm making a mailbox module to my app and here's where I've bumped a wall. How to store a password to the user's mailbox, so the server of my app can read it from database, make a call to mail server and get messages?
If I'll store it as plain text - it's obvious suicide.
If I'll encrypt it (hash) - it's unreversible so I can't properly sign in to mail server.
What to do?? Help please! :)
Thank you in advance and best regards,
Tom
java database email passwords
asked Nov 19 '18 at 16:33
T.Fruba
436
|
show 2 more comments
I know there are dozens of topics about storing a passwords in DB, but all of them are missing one approach: what if I want to use this password to authenticate my app to an external service?
Today I'm making a mailbox module to my app and here's where I've bumped a wall. How to store a password to the user's mailbox, so the server of my app can read it from database, make a call to mail server and get messages?
If I'll store it as plain text - it's obvious suicide.
If I'll encrypt it (hash) - it's unreversible so I can't properly sign in to mail server.
What to do?? Help please! :)
Thank you in advance and best regards,
Tom
java database email passwords
asked Nov 19 '18 at 16:33
T.Fruba
436
If you already store passwords in DB, why not store the mail password there too? --- Or did you mean "storing a passwords for connecting to DB"? If so, why not store the mail password in the same place as the DB passwords?
– Andreas
Nov 19 '18 at 16:38
I am storing a passwords used for app authentication. They are hashed/salted and during the log in - password is hashed/salted on client side and compared with the one stored in DB. That's ok. But... The user can also enter his/hers mail server settings so the mailbox will be read and he/she can read/reply/compose mail etc. And with the password for mailbox I have a problem.
– T.Fruba
Nov 19 '18 at 16:44
Then you need to encrypt, not hash, the email password.
– Andreas
Nov 19 '18 at 16:50
What I mean by the above is that a app engine is to perform periodic check if there's new mail etc. So the engine needs to call a mail server and introduce itself with username and password entered by user and stored in database. What I'm trying to do here is to avoid storing a plain-text password in database.
– T.Fruba
Nov 19 '18 at 16:52
1
encrypt =/= hash, one is reversible, the other is not.
– luk2302
Nov 19 '18 at 16:53
|
show 2 more comments
I know there are dozens of topics about storing a passwords in DB, but all of them are missing one approach: what if I want to use this password to authenticate my app to an external service?
Today I'm making a mailbox module to my app and here's where I've bumped a wall. How to store a password to the user's mailbox, so the server of my app can read it from database, make a call to mail server and get messages?
If I'll store it as plain text - it's obvious suicide.
If I'll encrypt it (hash) - it's unreversible so I can't properly sign in to mail server.
What to do?? Help please! :)
Thank you in advance and best regards,
Tom
java database email passwords
asked Nov 19 '18 at 16:33
T.Fruba
436
I know there are dozens of topics about storing a passwords in DB, but all of them are missing one approach: what if I want to use this password to authenticate my app to an external service?
Today I'm making a mailbox module to my app and here's where I've bumped a wall. How to store a password to the user's mailbox, so the server of my app can read it from database, make a call to mail server and get messages?
If I'll store it as plain text - it's obvious suicide.
If I'll encrypt it (hash) - it's unreversible so I can't properly sign in to mail server.
What to do?? Help please! :)
Thank you in advance and best regards,
Tom
java database email passwords
java database email passwords
asked Nov 19 '18 at 16:33
T.Fruba
436
asked Nov 19 '18 at 16:33
T.Fruba
436
asked Nov 19 '18 at 16:33
T.Fruba
436
asked Nov 19 '18 at 16:33
T.Fruba
436
asked Nov 19 '18 at 16:33
T.Fruba
436
436
If you already store passwords in DB, why not store the mail password there too? --- Or did you mean "storing a passwords for connecting to DB"? If so, why not store the mail password in the same place as the DB passwords?
– Andreas
Nov 19 '18 at 16:38
I am storing a passwords used for app authentication. They are hashed/salted and during the log in - password is hashed/salted on client side and compared with the one stored in DB. That's ok. But... The user can also enter his/hers mail server settings so the mailbox will be read and he/she can read/reply/compose mail etc. And with the password for mailbox I have a problem.
– T.Fruba
Nov 19 '18 at 16:44
Then you need to encrypt, not hash, the email password.
– Andreas
Nov 19 '18 at 16:50
What I mean by the above is that a app engine is to perform periodic check if there's new mail etc. So the engine needs to call a mail server and introduce itself with username and password entered by user and stored in database. What I'm trying to do here is to avoid storing a plain-text password in database.
– T.Fruba
Nov 19 '18 at 16:52
1
encrypt =/= hash, one is reversible, the other is not.
– luk2302
Nov 19 '18 at 16:53
|
show 2 more comments
If you already store passwords in DB, why not store the mail password there too? --- Or did you mean "storing a passwords for connecting to DB"? If so, why not store the mail password in the same place as the DB passwords?
– Andreas
Nov 19 '18 at 16:38
I am storing a passwords used for app authentication. They are hashed/salted and during the log in - password is hashed/salted on client side and compared with the one stored in DB. That's ok. But... The user can also enter his/hers mail server settings so the mailbox will be read and he/she can read/reply/compose mail etc. And with the password for mailbox I have a problem.
– T.Fruba
Nov 19 '18 at 16:44
Then you need to encrypt, not hash, the email password.
– Andreas
Nov 19 '18 at 16:50
What I mean by the above is that a app engine is to perform periodic check if there's new mail etc. So the engine needs to call a mail server and introduce itself with username and password entered by user and stored in database. What I'm trying to do here is to avoid storing a plain-text password in database.
– T.Fruba
Nov 19 '18 at 16:52
1
encrypt =/= hash, one is reversible, the other is not.
– luk2302
Nov 19 '18 at 16:53
If you already store passwords in DB, why not store the mail password there too? --- Or did you mean "storing a passwords for connecting to DB"? If so, why not store the mail password in the same place as the DB passwords?
– Andreas
Nov 19 '18 at 16:38
If you already store passwords in DB, why not store the mail password there too? --- Or did you mean "storing a passwords for connecting to DB"? If so, why not store the mail password in the same place as the DB passwords?
– Andreas
Nov 19 '18 at 16:38
I am storing a passwords used for app authentication. They are hashed/salted and during the log in - password is hashed/salted on client side and compared with the one stored in DB. That's ok. But... The user can also enter his/hers mail server settings so the mailbox will be read and he/she can read/reply/compose mail etc. And with the password for mailbox I have a problem.
– T.Fruba
Nov 19 '18 at 16:44
I am storing a passwords used for app authentication. They are hashed/salted and during the log in - password is hashed/salted on client side and compared with the one stored in DB. That's ok. But... The user can also enter his/hers mail server settings so the mailbox will be read and he/she can read/reply/compose mail etc. And with the password for mailbox I have a problem.
– T.Fruba
Nov 19 '18 at 16:44
Then you need to encrypt, not hash, the email password.
– Andreas
Nov 19 '18 at 16:50
Then you need to encrypt, not hash, the email password.
– Andreas
Nov 19 '18 at 16:50
What I mean by the above is that a app engine is to perform periodic check if there's new mail etc. So the engine needs to call a mail server and introduce itself with username and password entered by user and stored in database. What I'm trying to do here is to avoid storing a plain-text password in database.
– T.Fruba
Nov 19 '18 at 16:52
What I mean by the above is that a app engine is to perform periodic check if there's new mail etc. So the engine needs to call a mail server and introduce itself with username and password entered by user and stored in database. What I'm trying to do here is to avoid storing a plain-text password in database.
– T.Fruba
Nov 19 '18 at 16:52
1
1
encrypt =/= hash, one is reversible, the other is not.– luk2302
Nov 19 '18 at 16:53
encrypt =/= hash, one is reversible, the other is not.– luk2302
Nov 19 '18 at 16:53
|
show 2 more comments
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53379003%2fsafe-storing-passwords-for-users-mailbox%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53379003%2fsafe-storing-passwords-for-users-mailbox%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
If you already store passwords in DB, why not store the mail password there too? --- Or did you mean "storing a passwords for connecting to DB"? If so, why not store the mail password in the same place as the DB passwords?
– Andreas
Nov 19 '18 at 16:38
I am storing a passwords used for app authentication. They are hashed/salted and during the log in - password is hashed/salted on client side and compared with the one stored in DB. That's ok. But... The user can also enter his/hers mail server settings so the mailbox will be read and he/she can read/reply/compose mail etc. And with the password for mailbox I have a problem.
– T.Fruba
Nov 19 '18 at 16:44
Then you need to encrypt, not hash, the email password.
– Andreas
Nov 19 '18 at 16:50
What I mean by the above is that a app engine is to perform periodic check if there's new mail etc. So the engine needs to call a mail server and introduce itself with username and password entered by user and stored in database. What I'm trying to do here is to avoid storing a plain-text password in database.
– T.Fruba
Nov 19 '18 at 16:52
1
encrypt =/= hash, one is reversible, the other is not.– luk2302
Nov 19 '18 at 16:53