Question

I’m working on an application which should import all e-mails from a user’s e-mail-account and store them in its own database for further use. The collection of all the e-mails should be done in a background job (via Delayed Job or similar).

To achieve this I’ll need to store the user’s email-password somewhere in my application. As this is going to be an internal application trusting my app won’t be the problem.

I am looking for a best practice on how and where to store these e-mail passwords as securely as it gets.

Encrypting the e-mail password with the user’s login password to my app is not an option, because I have to run the job in the background.

Any advice on this? Thanks in advance.

Env: Rails 3.2 with MongoDB

Answer 1

I solved it by using the attr_encrypted Gem. Be sure to use the encoding: true option when using MongoId.

As the key for the encryption I use my application’s secret token. I think that’s secure enough for my purpose.

Thanks to this answer: https://stackoverflow.com/a/6686132/1437361