I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature.
The feature is that the notification e-mails sent to the user by the appliance will be sent using the user credentials (e-mail and e-mail password) using whatever mail server the user uses (gmail, local mail server, etc)
These credentials are inside the machine in plain text, and is available with a cat to the right file. The developer argues that there is no point in trying to use any encryption because they always will need to decrypt it when sending the credentials to the mail server.
Now I do not know what to think, is there a correct way of doing this? or is the feature insecure and there is no secure way of doing it?