'Send SMTP Mail Message' Password - SecureString

[Langdeel (Jan Pedersen)]

Hi

The UiPath activity ’Send SMTP Mail Message’ needs a password in the properties pane for it to work. This password just needs to be a String but this is not a good solution as the password then will be exposed. I would like to request that it is changed so that it should be a SecureString.

Thanks!

[badita (Mihai Badita)]

We have in mind this idea: all the activities that requires a password (email, terminals, office, etc) should accept a secureString as parameter.

However, it takes time so we do not look at it as having high priority.

Till then the solution is to convert the secureString to a String:

Convert SecureString to String - Get Secured Credential

@andraciorici, @Lavinia Before I was able to store email passwords in the Windows Credential Store and pass them to the Email activities as variables. How am I going to achieve this since now I can retrieve only secured string which works only in type. Am I missing something?

[Langdeel (Jan Pedersen)]

Hi

Thank you for your answer. Our security department is not happy about it so I would personally think it should be high priority But thank you for the workaround!

[Amrita_Mogali]

@badita Do we know when do we have this planned? I have been asked this question a lot lately

[badita (Mihai Badita)]

We’re thinking about it.

Now, how would you see a possible implementation taking into account that:

• You can anyway get the password out of a secure string
• you may need to type password in different apps…therefore you can type it in notepad

Isn’t this enough?

Security Concerns!

This is an excellent question and here is how UiPath mitigates it in enterprise deployments. 1. Release Cycle Every workflow that goes into production needs a reviewer approval (the reviewer is the one who pushes the workflow via Orchestrator). Now, he should check how all the SecureStrings are used…to make sure that SecureStrings are not entered into notepad and sent via email. That’s easy using Search. 2. Source Control You can track the developer that entered malicious code within the wor…

[Amrita_Mogali]

I agree. But if we put it as a secure string, we can at least have the SMTP password stored in Assets under credentials and not visible as plain text. I am aware of the case where they could type into a notepad exposing the password. But in that case, the code reviewers have to ensure that the password is typed in the correct region. It makes a lot of clients uncomfortable seeing the passwords being visible as plain text. In my opinion it would be better to have something(secure string for the moment) rather than nothing

[Akhil]

Hai,
Till now this problem is unsolved or solved ?

[Gabe_Odess]

Hello, I would also like to see a solution to this problem.

[Aloha_First]

is there any solution?

[eero.kankare]

I would say that this should be high priority. It’s hard to explain to clients how UiPath takes security seriously when the passwords are stored in plain text.

[Krissi]

Hello,
I’m also looking forward for a solution.
@badita Thank you for the suggested workaround

[iRon (Ronald Bode)]

Meanwhile, I have written a workflow for this that safely stores the password in the Windows credential manager at the first invocation (similar as you do for a general logon):
SendMail.xaml (22.0 KB)

[snoopy (EJ)]

Really hoping for SecureString input in SMTP mail activity, we use this to send e-mails from the robot user, and users (process owners) have access to Orchestrator to manage their projects assets.

[Imran (Imran Shaikh)]

What I did as a workaround is created another extra string variable for password like “StrPassword” and it Solved my Problem

Follow these steps
Create a Variable StrPassword

Then taken a assign activity and assign value for StrPassword

And in value typed the string as

“new System.Net.NetworkCredential(string.Empty, password).Password”

Where “password” contains your secure string that you get from orchestrator assests or windows credentials

[rstaylor62 (Scott taylor)]

One other thought, you do not need to create a String Variable or use the Assign Activity, you can simply put the following statement into the SMTP Password Property (Field):
“new System.Net.NetworkCredential(string.Empty, password).Password”

[hta (Hieu Ta)]

Hi,

I notice that Password field in mail activities like Get IMAP Mail Messages and Send SMTP Mail Messages are just String instead of SecureString.

This is disadvantageous. First of all it reveal password*. Secondly it disallow centralization of asset data. For example, I cannot centrally store password on Orchestrator and use Get Credential activity to retrieve it.

Please kindly consider making change to these activities by changing Password field data type from String to SecureString.

*There is similar question about encrypting password. One recommendation is to use GetPassword activity but the output string is still totally visible.

How to encrypt password while using mail automation?

Hi, How to encrypt password in mail password feild while using IMAP mail automation.

BR,
Hieu

[richarddenton]

This is a known issue for a long time. Not sure whether there are plans to change this @badita.

There is a workaround as you can pass as a secure string and only convert at the very last instance prior to entering the string into the activity. The only risk here is if someone is able to get on the machine, amend the process to log that value and also run the process. Given the controls around the machine and the Orchestrator this is a pretty low risk in my opinion.

RD

[Florent_Salendres]

Convert SecureString to String - Get Secured Credential

As Genfour suggested we need to create an activity that returns a string from a SecureString. Until then String plainStr = new System.Net.NetworkCredential(string.Empty, secureStr).Password should work

[hta (Hieu Ta)]

Thanks for your input. I manage to get asset’s password from Orchestrator and pass on to send email activity. As you can see there is no proper solution to protect secure info as long as we have to convert a SecureString to String value.
I look forward to having this fixed.
/Hieu

[badita (Mihai Badita)]

Closed as duplicate:

'Send SMTP Mail Message' Password - SecureString

Hi The UiPath activity ’Send SMTP Mail Message’ needs a password in the properties pane for it to work. This password just needs to be a String but this is not a good solution as the password then will be exposed. I would like to request that it is changed so that it should be a SecureString. Thanks!