Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 4 down vote favorite

I am developing a system for mailing which has a account id/password to login and I need to store the smtp server account and password for sending mail. Since the mail is auto send I can't request the user input password/id each time when sending.

Therefore, is storing the user account id/password (system b password) in my system (system a) insecure design? How can I improve this?

share|improve this question
Hello, I added some formatting and tried to map your title to the description of your questions since it took me a little time to figure out. I hope I kept the original meaning of your question. – Oeufcoque Penteano 13 mins ago – Oeufcoque Penteano Apr 11 '12 at 17:09

1 Answer

up vote 3 down vote

I don't know in which language/platform you are developing your applications, but for .NET you can take advantage of encrypting and decrypting configuration sections. To my knowledge these sections are meant to store sensitive data, like passwords. You can also place other date, like SMTP server, account, etc. in it.

I'm pretty sure other languages have similar protection mechanisms.

One thing I saw for the Orchard CMS installations, the username and password for databases are stored (in plain text) in the App_Data folder. Users can't really access these folders, so it's rather safe, but if your server/web application gets hacked, one could easily gain access in the database.

If you want to be sure, encrypt the information, but make sure you can decrypt it in your application.

share|improve this answer
it can only be stored as plain text in database because the system is different, if in the same system i can hash pwd and compare with my database. if the system is different, i can store the hash value but i still need to return it to the plaintext pwd before it can be input in system b – user782104 Apr 11 '12 at 17:42
I'm not really familiar with encryption and decryption mechanisms, so Tangurena's hint might help you better. From my basic understandings of cryptography, I'd suggest using some public/private key mechanism, so you can encrypt and decrypt values when necessary. Don't know if this is the right approach though as I haven't had the need to do a lot of research on the matter. – Jan_V Apr 11 '12 at 20:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.