I have a feature request to connect my PHP web-app to the users mail server. I have usually strayed away from this type of work as it will mean storing the users email passwords.
My question: is it secure to store a users third party email password, if the email password is encrypted using PHP's openssl functionality, of which the private key will be some hashed version of the users login password to the PHP application. (Users login passwords will be hashed using a different algorithm for authentication purposes.) The plaintext password to the web-app will not be stored in the server.
Upon user login, we can use the plain text password to access the private key to the users encrypted email password. This could then be re-encrypted using openSSL, with a daily refreshed server key.
The result (or part thereof) of that encryption, could be stored as a cookie in the users browser, only accessible every time the user loads a page in the web-app.
Is this method effective for ensuring the security of the third party email passwords?