0
\$\begingroup\$

I am currently working on a Unity Asset that involves sending emails using Gmail's SMTP server. As part of the setup, developers using the asset are required to input their email address and the corresponding App Password for authentication.

Recently, I encountered a problem during the submission of my Unity Asset. The rejection reason stated that the email credentials were not stored securely and could potentially be exposed in the built project, violating security guidelines (Section 1.5.b: API key storage non-secure).

Here's a summary of my situation:

  • My Unity Asset requires email credentials for SMTP server usage, specifically the App Password for Gmail.

  • The credentials are currently stored directly within the Unity project, leading to security concerns.

  • I attempted to reach out to Unity for guidance, but their response suggested exploring alternatives without providing specific solutions tailored to my implementation.

  • I am seeking advice and suggestions from the community on how to securely store email credentials, especially considering the sensitivity of the App Password. I want to ensure that the credentials are adequately protected to prevent unauthorized access or exposure in the built project.

Here is my Code that is causing the problem:

[Header("Mail Credentials\n")]

//This where Mail credentials is Initilized/store.

[SerializeField] private string ReceiverMail = "[email protected]";
[SerializeField] private string SenderMail = "[email protected]";
[SerializeField] private string appPassword = "SenderMailAppPassword(dfkfjjfkjgmnfk)";


private async void SendMail()
{
        //code.....

        mail.From = new MailAddress(SenderMail);

        mail.To.Add(ReceiverMail);

        //code.....

        //This is where Sender Mail credentials is used in entire Code
        smtpServer.Credentials = new System.Net.NetworkCredential(SenderMail, appPassword) as ICredentialsByHost; 

        //code.....

}


How can I best solve this problem?

\$\endgroup\$
5
  • 3
    \$\begingroup\$ Honestly, I wouldn't trust an asset that asked for my gmail credentials. Those could be sent anywhere. \$\endgroup\$
    – Almo
    Commented Mar 26 at 17:39
  • 1
    \$\begingroup\$ You're going to need to be more specific. Why do you need this feature, and how it is used? Do users send emails in the final application, or are they only sent from the Editor? What platforms are you targeting (desktop/mobile/web/etc)? Keep in mind there's no safe way to store credentials like an app password in a build that end users can download; you can encrypt the password, but then you need to have the encryption key in the build, so someone will eventually figure out how to decrypt it. \$\endgroup\$
    – Kevin
    Commented Mar 26 at 18:02
  • \$\begingroup\$ @Kevin The credentials are set by developers and system is used by users to send feedback (for all platform). I have relized that its a dumb idea/method for sending feedback especially when its implemented in Unity Assest. What are other methods that can be use to send feedback/mails? \$\endgroup\$ Commented Mar 26 at 18:22
  • 2
    \$\begingroup\$ You could have a seperate server running somewhere and just do a post request against that. Or a <a href="mailto: or a discord link for your asset. Or a link to the asset store/ forum where usually bugs/ feedback is reported \$\endgroup\$
    – Zibelas
    Commented Mar 26 at 20:37
  • 1
    \$\begingroup\$ Google offers an OAuth workflow. That means you'd show a webpage, the user would log in to Google (without you seeing their creds) then they'd get a "Do you want to allow this app to ..." dialog. If they say "Yes", you get a token that you can then use to perform certain actions on their behalf. Are you aware of it/is there any reason you wouldn't use it? developers.google.com/identity/protocols/oauth2 \$\endgroup\$
    – Basic
    Commented Mar 26 at 21:57

1 Answer 1

3
\$\begingroup\$

Since your goal is to send feedback to yourself, there are others ways instead of storing or even giving the credentials to the asset. As Almo pointed out, giving your credentials to a random asset is giving away your credentials.

  • You could have somewhere your own server and do a post request against your endpoint. Not fully an email, but would be close enough.
  • You could use a <a href="mailto: link to open a local mail provider if the target system allows it.
  • You could link to a discord (or other online forum) dedicated to your asset.
  • You could link to the Unity Forum for assets (to a thread dedicated to your asset)

There is even a bigger benefit of a forum based solution compared to email. It is easier for others to see, to edit and review a question. People who are taking their time to write good feedback or wanting to reports bugs won't mind usually the extra few minutes. And are usually as well tech savy enough to handle more than an email.

\$\endgroup\$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .