Passwords are secret codes that keep your information private and protects access to applications and websites meant only for you. The University takes strong measures to protect the integrity of your password by only storing an unencryptable version of your password and by enforcing a password expiration policy (see: Password Expiration).
Even with these safeguards, we need to choose strong passwords (so that intruders can’t guess our password) and then protect them well.
Choosing a strong password
There are 3 guidelines to follow to create a strong password:
- A large character set.
- The larger the set of characters you choose from, the more possibilities that a computer has to guess for each character of your password. If you use only lower case letters, that’s 26. Include uppercase and you have 52. Add numbers and special characters and you have increased the character set to 95 possibilities for each character of your password.
- A long password.
- Using our 95 characters to choose from, if we choose a 2 character password, there would be 8,930 combinations to test in order to guess your password. For a 4 character password, there are 76,405,080 combinations! The guessing is usually done by computers which are very fast. We require a minimum of 8 characters in our standards, but longer is always better when it comes to passwords.
- Memorable is better.
- It’s possible to follow the guidelines above (and the strong password policy) and still have a password you can remember and don’t have to write down.Don’t use passwords that are based on things that could be easily guessed (a spouse or child name, for instance), but start with something memorable, for example a portion of a song lyric, sprinkle some upper and lowercase, numbers and special characters and you’ll have a password that you can more easily remember. Personalize the way you alter the base of the password. For instance, don’t capitalize only the first letters. Don’t substitute one’s for lowercase “L”s – these are all known strategies that a person trying to guess a password would use. And when you change your password, don’t make the new one memorable by using the old password and changing the last character to be the next number in line – start fresh each time you set a new password.
Be careful where you change your password!
A common practice by hackers is to pose as local IT service people in mail and ask you to change your password or confirm you are using your account by supplying your password. This is a ploy to gain access to your account, and is called Phishing.
Here’s how you can distinguish between a legitimate password expiration notification and a Phishing attempt:
- We will never ask you for your password in mail or otherwise
- Password expiration email will always come from accounts@maine.edu
- We will not send a direct link to the password change page, but will tell you how to get to it.
- The password change utility will always be on a maine.edu URL
Password Expiration
When passwords expire:
Passwords will expire 180 days after being set.
Password expiration notification:
You will be notified by email of the upcoming expiration by email at 30, 14, 7 and 3 days before the password expires. The email will direct you to the accounts management site where you can change your password. We will never ask you to send us your password. If you receive email that asks you to do that, do not reply to the email.
How do I change my password:
Visit the Accounts management page and select “Change your password“. You will need to know your account username (the part before the @ sign in your email address) as well as your current password. Your new password must contain a minimum of 8 characters and include a minimum of one upper case letter, one lowercase letter, and a number or special character. See [ ] for more information about creating good passwords.
What if I forgot my password:
If you have forgotten your password and you are within the guidelines explained below, you can set a new password by using the questions and answers you supplied during account activation. Visit the Accounts Management Page and choose “Recover a lost password“. You must know your student or employee ID (often called EMPLID) and your current account username (the part before the @ sign in your email address). Once you have answered your questions you will be able to set a new password.
What happens if your password expires:
If your password has expired, you cannot log into the account, but you may still use thepassword change pageto change your password for the next 180 days. During this time, email sent to you is received and stored (providing the mailbox is not full) or forwarded if a mail forward is set.
After 180 days past expiration, your account is deactivated and you must visit a help desk to reactivate your account. Email continues to be received and stored, or forwarded.
After 360 days past expiration, if not a current student or employee your account will be deleted. This applies to retirees, alumni, guests, contractors and so on. An email announcing the pending deletion will be sent at 30 and 14 days prior to deletion. Mail is received or forwarded until the account is deleted. Student and employee accounts will be kept in the deactivated state.
If you have any questions please call the Support Center at 1-800-696-HELP (1-800-696-4357) or email them at techsupport@maine.edu
