CODEWITHSUNDEEP
pythonpassword-encryption
cording12
cording12

Reputation: 166

How to store a password in my python script but have it obscured from any users when deployed to Github?

I've been trying to work this one out for a while now but keep finding imperfect solutions - I think what I want to do is possible but maybe I'm not phrasing my Google search correctly.

I have a Python script that sends a user an email notification - in order to send said email I need to provide a password in the script to send the email. The code works perfectly but it requires that I pass the password into the script:

def send_email():
    import smtplib
    import ssl
    from email.mime.text import MIMEText
    from email.mime.multipart import MIMEMultipart

    sender_email = "[email protected]"
    receiver_email = "[email protected]"
    password = "my_password_here"  

    message = MIMEMultipart("alternative")
    message["Subject"] = "subject_here"
    message["From"] = sender_email
    message["To"] = receiver_email

    # Create the plain-text and HTML version of your message
    text = f"""\
    Plain text body here
    """

    # Create secure connection with server and send email
    context = ssl.create_default_context()
    with smtplib.SMTP_SSL("smtp.gmail.com", 465, context=context) as server:
        server.login(sender_email, password)
        server.sendmail(
            sender_email, receiver_email, message.as_string()
        )

I don't want to store the password as plain text for obvious reasons. I've thought of environment variables but this wouldn't work as this is going to be deployed on GitHub for other people to use (or install as an EXE) so this would break the email functionality.

I've tried looking at PyCryptodome but anything I've found so far suggests encrypting the password with a key but then storing the key in the script to decrypt the password when you use it. This seems like a bad idea to me as surely any novice (like me!) would be able to easily decrypt this because the key is stored in the script.

Is anyone able to help push me in the right direction? I'm completely out of ideas as frankly I know hardly anything about password storing/security so not even sure what I should be Googling!

Upvotes: 1

Views: 787

Answers (1)

Rafael
Rafael

Reputation: 574

If others have to use your password to be able to use your script, it's impossible. If the computer can read it, then the user will also find a way to read it.

I recommend using a E-Mail service where the user can enter their own API key or just let them enter their own GMail credentials.

Correct me if I'm wrong, but I think there's no way to use your password in this case unless you write an API and send the E-Mail from your server. But don't forget that in this case, the user might be able to use your API as a way to send spam.

TL;DR: Let the users use their own passwords.

Upvotes: 2

Related Questions