0
\$\begingroup\$

I am currently working on a Unity Asset that involves sending emails using Gmail's SMTP server. As part of the setup, developers using the asset are required to input their email address and the corresponding App Password for authentication.

Recently, I encountered a problem during the submission of my Unity Asset. The rejection reason stated that the email credentials were not stored securely and could potentially be exposed in the built project, violating security guidelines (Section 1.5.b: API key storage non-secure).

Here's a summary of my situation:

  • My Unity Asset requires email credentials for SMTP server usage, specifically the App Password for Gmail.

  • The credentials are currently stored directly within the Unity project, leading to security concerns.

  • I attempted to reach out to Unity for guidance, but their response suggested exploring alternatives without providing specific solutions tailored to my implementation.

  • I am seeking advice and suggestions from the community on how to securely store email credentials, especially considering the sensitivity of the App Password. I want to ensure that the credentials are adequately protected to prevent unauthorized access or exposure in the built project.

Here is my Code that is causing the problem:

[Header("Mail Credentials\n")]

//This where Mail credentials is Initilized/store.

[SerializeField] private string ReceiverMail = "[email protected]";
[SerializeField] private string SenderMail = "[email protected]";
[SerializeField] private string appPassword = "SenderMailAppPassword(dfkfjjfkjgmnfk)";


private async void SendMail()
{
        //code.....

        mail.From = new MailAddress(SenderMail);

        mail.To.Add(ReceiverMail);

        //code.....

        //This is where Sender Mail credentials is used in entire Code
        smtpServer.Credentials = new System.Net.NetworkCredential(SenderMail, appPassword) as ICredentialsByHost; 

        //code.....

}


How can I best solve this problem?

\$\endgroup\$
5
  • 3
    \$\begingroup\$ Honestly, I wouldn't trust an asset that asked for my gmail credentials. Those could be sent anywhere. \$\endgroup\$
    – Almo
    Mar 26 at 17:39
  • 1
    \$\begingroup\$ You're going to need to be more specific. Why do you need this feature, and how it is used? Do users send emails in the final application, or are they only sent from the Editor? What platforms are you targeting (desktop/mobile/web/etc)? Keep in mind there's no safe way to store credentials like an app password in a build that end users can download; you can encrypt the password, but then you need to have the encryption key in the build, so someone will eventually figure out how to decrypt it. \$\endgroup\$
    – Kevin
    Mar 26 at 18:02
  • \$\begingroup\$ @Kevin The credentials are set by developers and system is used by users to send feedback (for all platform). I have relized that its a dumb idea/method for sending feedback especially when its implemented in Unity Assest. What are other methods that can be use to send feedback/mails? \$\endgroup\$ Mar 26 at 18:22
  • 2
    \$\begingroup\$ You could have a seperate server running somewhere and just do a post request against that. Or a <a href="mailto: or a discord link for your asset. Or a link to the asset store/ forum where usually bugs/ feedback is reported \$\endgroup\$
    – Zibelas
    Mar 26 at 20:37
  • 1
    \$\begingroup\$ Google offers an OAuth workflow. That means you'd show a webpage, the user would log in to Google (without you seeing their creds) then they'd get a "Do you want to allow this app to ..." dialog. If they say "Yes", you get a token that you can then use to perform certain actions on their behalf. Are you aware of it/is there any reason you wouldn't use it? developers.google.com/identity/protocols/oauth2 \$\endgroup\$
    – Basic
    Mar 26 at 21:57

2 Answers 2

3
\$\begingroup\$

Since your goal is to send feedback to yourself, there are others ways instead of storing or even giving the credentials to the asset. As Almo pointed out, giving your credentials to a random asset is giving away your credentials.

  • You could have somewhere your own server and do a post request against your endpoint. Not fully an email, but would be close enough.
  • You could use a <a href="mailto: link to open a local mail provider if the target system allows it.
  • You could link to a discord (or other online forum) dedicated to your asset.
  • You could link to the Unity Forum for assets (to a thread dedicated to your asset)

There is even a bigger benefit of a forum based solution compared to email. It is easier for others to see, to edit and review a question. People who are taking their time to write good feedback or wanting to reports bugs won't mind usually the extra few minutes. And are usually as well tech savy enough to handle more than an email.

\$\endgroup\$
-1
\$\begingroup\$

Consider "Isolated Storage".

Using isolated storage enables partially trusted applications to store data in a manner that is controlled by the computer's security policy.

https://learn.microsoft.com/en-us/dotnet/standard/io/isolated-storage

\$\endgroup\$
6
  • \$\begingroup\$ How would you use this to solve the problem of letting users send the developer feedback without exposing credentials in the asset? \$\endgroup\$
    – DMGregory
    Mar 28 at 21:14
  • \$\begingroup\$ @DMGregory OP has "hardcoded" the credentials in the source code; that's an obvious problem (scan the source). Isolated storage is a mechanism for storing data and retrieving it that is only exposed at run time (to the app). We're trying to second guess Unity here. My apps are "certified" for the Windows Store. It works the same way; it just tells you when it doesn't like something. The missing piece is storing the creds in the first place. (Who, when, where) \$\endgroup\$ Mar 28 at 21:32
  • \$\begingroup\$ @GerrySchmitz does this work for all platforms(windows,linux/android,ios)? \$\endgroup\$ Mar 29 at 6:15
  • 1
    \$\begingroup\$ @GerrySchmitz This answer is not applicable to the question. Isolated storage is used at runtime for storing data. The OP was asking how to safely include credentials in a build, not to generate and store them at runtime. \$\endgroup\$
    – Kevin
    Apr 11 at 1:25
  • \$\begingroup\$ @Kevin Now deleting my comments? I repeat, OP has not determined a "specific issue"; he has a general "acceptance test" issue with no specific guidance from Unity. You assume too much. \$\endgroup\$ Apr 11 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .