Quote (oOn @ Jan 12 2015 11:39pm)
I have a java app where I am sending an email from a gmail account, but the credentials (username / pw) are currently hardcoded.
What is a safe and easy way to fetch and use the login credentials?
Edit: I'm kinda realizing now that even if the credentials were stored server-side, a hacker could still be able to see the password when it runs through this part of the code.
Code
class GMailAuthenticator extends Authenticator {
String user;
String pw;
public GMailAuthenticator (String username, String password)
{
super();
this.user = username;
this.pw = password;
}
public PasswordAuthentication getPasswordAuthentication()
{
return new PasswordAuthentication(user, pw);
}
}
Honestly you might not need any salty hashes, with the Java I usually see, I doubt an attacker would waste his time reading through it.
In all seriousness, don't do your own crypto or security, use a library that does it, salt your hashes definitely, but do it right.
You could do cute stuff like
passwordstring.toCharArray(); too, but that isn't going to stop someone who's already on your server.
Look into Bcrypt, in my opinion.
https://www.google.com/search?q=bcrypt+java&oq=bcrypt+java