Re:Panama Papers: Email Hackable via WordPress, Docs Hackabl...
by kijin on Saturday April 09, 2016 @03:17AM
(#11460323)
Serious answer: you don't store them at all.
Transactional email services will usually give you a disposable API key that can only be used to send email. If the key is compromised, the worst that can happen is that your server will try to send spam and get blocked by the email service.
Many of the same services can also be configured to issue an HTTP request to a URL of your choice if an email bounces. You could write a WordPress plugin to handle that if you want. No need to keep POP/IMAP passwords in your database.
There is no need for your website to go anywhere near your regular, human-accessible POP/IMAP/SMTP mailbox.
Re:Panama Papers: Email Hackable via WordPress, Docs Hackabl...
by icebraining on Saturday April 09, 2016 @04:11AM
(#11460451)
An API key is a password. That said, I fully agree that you shouldn't use your main password, but of an account with reduced permissions.
When you're the server, you can hash them, but when you're the client, you need to access the credentials in order to send them to the remote server, so you can't hash them. You could encrypt them, but you'd need the decryption key readable by WP anyway, so it'd just be security theater.
See https://developer.pidgin.im/wiki/PlainTextPasswords