Keeping your passwords safe

• Never share your account with anyone or let anyone else use your account. Never give your password to anyone, including Yale IT staff members or your supervisor.
• Do not write down your password on paper or store it on a computing device.
• Do not use your NetID password as a password for another computer system, such as your ATM card PIN number or as your password to a website on the Internet.
• Do not let anyone see you type in your password. Stop typing if you notice someone watching you. Make sure your password is not being displayed on your screen as you type.
• Do not save or store your NetID password in a dialup PPP or VPN script.
• Be wary of any program or web page that asks you for your NetID password. Secure Yale web pages that ask you for your NetID password will have URLs that begin with "https://" (see below). If you are being prompted for your NetID password from a web page that you do not recognize, or if the page appears different from the screen you are familiar with, contact ITS to verify the authenticity of the page.
• Do not enter your passwords when using insecure protocols (e.g. programs that transmit user account and password information unencrypted) over unsafe networks:
  • Configure your email software to use secure protocols (e.g., TLS/SSL for both sending and receiving email)
  • If you use your NetID password in an insecure manner or from an insecure location you should change your password as soon as possible.
• If your NetID password has been compromised, contact the Information Security Office (ITS). The first security measure the Information Security Office (ISO) will usually recommend will be to change your password, but ISO will also want to determine how the account and password was compromised, the impact of the exposure and whether to investigate, file a complaint, or prosecute.

How to tell if a web page is secure

Never provide any password on a web page that is not secure. There are two quick ways to tell if a web page is secure:

1. Look for the "https" in the URL address line at the top of the browser window.

 

2. Look for a small closed padlock icon within your browser window. The lock icon locations vary, depending on your brand of web browser:

 

---

Related topics

• Preventing identity theft
• Identity theft: What you know can protect you

Related University Policies & Procedures

• Guide 1610 - Selecting Good Passwords
• Yale security and access policies
• Procedure 1610 - Systems and Network Security

Other resources

• U.S. Government: OnGuard Online
• U.S.-FTC: Protecting Personal Information