I make email client over IMAP protocol. To "remember" user's connection details (email, password, host, etc.) I need to store password in plain text, because otherwise I won't be able to open connection again.
Is there is a way to open IMAP connection usinng hashed password? Any other solutions are welcome.
The supported authentication methods depend on the specific IMAP server. Some supported methods like XOAUTH2 which delegate the authentication to some external server via OAuth2. There are also methods like CRAM-MD5 which don't transfer the password in plain. While with CRAM-MD5 it might be possible to store the password hashed (but not salted) it does not help much if the attacker can compromise the local password storage:
If an attacker steals these credentials they can identify themselves as valid user to the server no matter if the hash or password is used. The difference is thus more relevant for transport protection but there it is better to use TLS anyway. And it is relevant to protect against password reuse - so it is better to have a unique password for the IMAP access.
