I have a Node JS app running on a cloud server. Part of the app requires validating users' emails, and this validation is done in the standard way: send email to user, user presses link, update database details, celebrate.
To send the email, I use the
nodemailer module. This module requires a username and password of a valid email account in order to send the email. There are two problems with this:
Simply putting the password in plaintext seems like a bad thing
I think it is possible that it has already been breached, since I am no longer able to log in to the account, neither from the server nor from their website (don't worry, no big deal)
- Actually, it may not have been breached, but:
Access to your account has been temporarily restricted as Yandex1 suspects it may have been hacked. This may have happened because you have entered your password on a fraudulent website or because your computer is infected with a virus.
Maybe this "fraudulent website" is my server, but I have been able to send emails automatically with this account not long ago, so I'm not sure.
I was considering two step verification with a single-app password, but I am not sure that that would even help since that password would exist in plain text just like the normal password.
What is the best way to set up this email account and store its username/password to be used automatically by the server?
1 The email service I was using was Yandex because they asked for very little information.