Search code examples
c#emailimap

C# Application Store Email/Password Safely / Not Hardcoded


I am currently developing a c# application in which I have to send an e-mail to some kind of request-storage. I found several ways to send mails in c# code and every one of them requires mail and password (Which makes totally sense). But I don't want to hardcode the mail or / and the password in my application. I think that would be the worst thing you could do in this situation.

Does anyone have an idea how it would be possible to store the e-mail and password safely and easy accessable without any webservice.


Solution

  • I'm assuming that your application is targeted at external users (i.e. not a service running on your own internal company server) and that your main concern about hardcoding the credentials is with having to update all instances of your application when the credentials change? I'd ask you in a comment but I don't have the reputation yet.

    You could store the credentials in encrypted form somewhere, e.g. a database and then decrypt them in-memory (you can just search for this, there are many example implementations available).

    Of course, someone could disassemble your application and discover your method of decryption and gain access to the credentials, so depending on whether you see this as a risk, you could consider protecting your code from disassembly using some third-party software.

    It can never be completely protected as long as your code runs on the users machine, but it would increase the effort required to obtain the credentials substantially, compared to storing the credentials somewhere in plain text.

    However, I'm not clear why you'd want to avoid using a webservice? That would be a nice way of separating the concern of sending emails from your application code. You could then completely change the implementation, without the client application having to worry about it.