'Send SMTP Mail Message' Password - SecureString

[Langdeel]

Hi

The UiPath activity ’Send SMTP Mail Message’ needs a password in the properties pane for it to work. This password just needs to be a String but this is not a good solution as the password then will be exposed. I would like to request that it is changed so that it should be a SecureString.

Thanks!

[badita]

We have in mind this idea: all the activities that requires a password (email, terminals, office, etc) should accept a secureString as parameter.

However, it takes time so we do not look at it as having high priority.

Till then the solution is to convert the secureString to a String:

Convert SecureString to String - Get Secured Credential

@andraciorici, @Lavinia Before I was able to store email passwords in the Windows Credential Store and pass them to the Email activities as variables. How am I going to achieve this since now I can retrieve only secured string which works only in type. Am I missing something?

[Langdeel]

Hi

Thank you for your answer. Our security department is not happy about it so I would personally think it should be high priority But thank you for the workaround!

[Amrita_Mogali]

@badita Do we know when do we have this planned? I have been asked this question a lot lately

[badita]

We’re thinking about it.

Now, how would you see a possible implementation taking into account that:

• You can anyway get the password out of a secure string
• you may need to type password in different apps…therefore you can type it in notepad

Isn’t this enough?

Security Concerns!

This is an excellent question and here is how UiPath mitigates it in enterprise deployments. 1. Release Cycle Every workflow that goes into production needs a reviewer approval (the reviewer is the one who pushes the workflow via Orchestrator). Now, he should check how all the SecureStrings are used…to make sure that SecureStrings are not entered into notepad and sent via email. That’s easy using Search. 2. Source Control You can track the developer that entered malicious code within the wor…

[Amrita_Mogali]

I agree. But if we put it as a secure string, we can at least have the SMTP password stored in Assets under credentials and not visible as plain text. I am aware of the case where they could type into a notepad exposing the password. But in that case, the code reviewers have to ensure that the password is typed in the correct region. It makes a lot of clients uncomfortable seeing the passwords being visible as plain text. In my opinion it would be better to have something(secure string for the moment) rather than nothing

[Akhil]

Hai,
Till now this problem is unsolved or solved ?

[Gabe_Odess]

Hello, I would also like to see a solution to this problem.