Hide mail server's credentials in source

Question

I have a desktop app, that send e-mail, using remote smtp-server. So in code I have smth like this:

string userName = "Alex";
string pass = "123456";
sendEmail(userName, pass);

Anyone, who reverse my app will have access to my mail-server. I wonder, is there any solutions to protect sensitive data (userName, pass) from reversing? Without obfuscating.

Thanks, Alex.

Answer 1

Move your SMTP credentials and other sensitive data to app.config and make use of section encryption.

Answer 2

If you supply a username and a password in your app, you should consider it exposed to the user - there is really no way to guarantee that the user does not examine your app or sniff the network connection.

Also, if is common to block SMTP traffic in firewalls and maintain a single smarthost, to avoid compromised machines becoming spambots. Even if you successfully manage to hide the credentials, using SMTP like this might be an unreliable choice.

You essentially have three options:

• Use the Send Email services of the OS - launching a mail in whatever email client the user has.
• Ask the user to configure a valid SMTP server.
• Set up your own relay to SMTP (for example as a web service), where you add additional checks and throttling to make sure it isn't misused.

The last option can of course be combined with authentication of the user against your own user database - that way you can shut down misbehaving users.