4 ms·
Just the fact that the credentials are sitting there in plain text would fail audits...
by Cshelton 11y ago
Just the fact that the credentials are sitting there in plain text would fail audits...
- eeeeeeeeeeeee 11y agoGimme a break. At some point the credentials need to be exposed to the client.
- icebraining 11y agoSerious question: how would you store them? When you're the server, you can hash them, but when you're the client, you need to access the credentials in order to send them to the remote server, so you can't hash them. You could encrypt them, but you'd need the decryption key readable by WP anyway, so it'd just be security theater. See https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/PlainTextPasswords
- kijin 11y agoSerious answer: you don't store them at all. Transactional email services will usually give you a disposable API key that can only be used to send email. If the key is compromised, the worst that can happen is that your server will try to send spam and get blocked by the email service. Many of the same services can also be configured to issue an HTTP request to a URL of your choice if an email bounces. You could write a WordPress plugin to handle that if you want. No need to keep POP/IMAP passwords in your database. There is no need for your website to go anywhere near your regular, human-accessible POP/IMAP/SMTP mailbox.
- icebraining 11y agoAn API key is a password. That said, I fully agree that you shouldn't use your main password, but of an account with reduced permissions.