I have a Node JS app running on a cloud server. Part of the app requires validating users' emails, and this validation is done in the standard way: send email to user, user presses link, update database details, celebrate.

To send the email, I use the nodemailer module. This module requires a username and password of a valid email account in order to send the email. There are two problems with this:

  1. Simply putting the password in plaintext seems like a bad thing

  2. I think it is possible that it has already been breached, since I am no longer able to log in to the account, neither from the server nor from their website (don't worry, no big deal)

    • Actually, it may not have been breached, but:

    Access to your account has been temporarily restricted as Yandex1 suspects it may have been hacked. This may have happened because you have entered your password on a fraudulent website or because your computer is infected with a virus.

    Maybe this "fraudulent website" is my server, but I have been able to send emails automatically with this account not long ago, so I'm not sure.

I was considering two step verification with a single-app password, but I am not sure that that would even help since that password would exist in plain text just like the normal password.

What is the best way to set up this email account and store its username/password to be used automatically by the server?

1 The email service I was using was Yandex because they asked for very little information.

  • FWIW, I don't think that message is the result of your password being leaked. More likely Yandex noticed that your app is sending a large number of emails in an automated fashion via that address, so their anti-spam system flagged it as "hacked". – Ajedi32 Jan 25 '18 at 22:19
  • @Ajedi32, do you know if it is possible to disable that? – Daniel Jan 25 '18 at 22:30
  • No idea, but I'd guess not. Webmail accounts like Yandex aren't really meant to be used the way you're using them here. That's why commercial services like Sendgrid exist. – Ajedi32 Jan 25 '18 at 22:33
  • @Ajedi32, do you know if there exists something free? I think security settings beyond a strong password are a non-issue given this is used only for automatic emails, right? – Daniel Jan 25 '18 at 23:16
  • Not of the top of my head, no. – Ajedi32 Jan 25 '18 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.