Passwords

East Carolina University
Department of Psychology

Managing Your Passwords

ECU has Required Standards for Passwords/phrases. How can one create and then remember all these strong passwords/phrases for ECU, online bank accounts, online credit cards, and on and on and on. Karl has some suggestions.

Creating a Strong Password

Start by creating a passphrase, such as "my son's major is geography."
Convert that into an acronym -- in this case, "msmig."
Insert a special character -- I recommend using one that does not require that you use the shift key -- that is, insert one of the following:
` - = [ ] \ ; ' , . /
Suppose now we have "=msmig."
Now insert one or more numbers -- for example, "01=msmig."
Be sure that the resulting password is at least 8 characters long.
Devise an easy scheme to change your password routinely. For example, you could use this rule -- the number at the beginning of the password is the month of the year and I will change my password every month.
Do not write down your password. Instead, put it in a Word document along with all of your other passwords, answers to questions to reset passwords, and all those annoying things you have to remember and keep secure.
Now all the hacker has to do to get your passwords is steal that Word document, right? Well, no, because you will immediately encrypt that Word document. There are many ways to encrypt a document, I prefer the free PGP software. There is a strong password that I use to decrypt PGP files, and I use that password often, rarely change it, and am not at great risk of forgetting it, barring brain trauma or senility. Whenever I forget one of my many passwords, I simply decrypt the PGP passwords document.

Do remember to securely wipe (erase) the unencrypted Word document -- PGP will do this for you.

How Often Should I Change My Password?

Once a month is good, but ECU does not require changes that frequently. On July 28, 1999 the Information Resources Coordinating Council (IRCC) passed an ECU NT Domain Password Expiration Policy. This policy requires the changing of your Exchange password every 90 days. This policy was implemented on December 3, 1999. You must change your password at least every 90 days. You will be sent an email reminder 15, 5, 2 and 1 day(s) prior to expiration. The ECU NT Domain Password Expiration policy may be viewed via the following url http://www.ecu.edu/itcs/policies/ntpassword.cfm.

How Do I Change my ECU INTRA Domain Password?

Use the passphrase maintenance self service system at https://pirateid.ecu.edu/ .
Your password be at least 8 characters long and must contain at least one character from each of at least three of the following categories: 1. lower case letters, 2. upper case letters, 3. numbers, and 4. special characters -- ~ ! @ # $ % ^ & * ( ) _ + { } | : " < > ? ` - = [ ] ; ' , . / . It will not be accepted if it is identical to one that you have used previously and which is in the system’s memory (which is 6 passwords). See Minimum Passphrase Standard.
The first time you go to the self service system at https://pirateid.ecu.edu/ you will have to register with the system. You will be asked to provide answers to two questions chosen from a list of questions and then you will be asked to provide a third question and answer of your own creation. Subsequently, answering these questions will get you in to the self service system.
Once you are in to the self service system, you can reset your password, unlock your account, get information on your account (such as when your current password will expire), and change your secret questions. When you reset your password, you should be prompted to provide a new password. Do so, exit the system, log off, and then log back in.
If you forget your password, or don’t change it often enough (in which case you will be locked out of your account), you need to either call the helpdesk (9866) or use the passphrase maintenance self service system at https://pirateid.ecu.edu/ . The latter method is preferred.
Too often I find that changing my password on the self-service system is followed by my account being locked out, in which case I cannot log back in to it. There is on the self-service site a way to unlock your account, but if you cannot log in to your account to get Internet access, this will not help you much -- you will have to call the help desk at 9866. They will reset your password to $<Rita Bilbro informed me that I am not allowed to tell you>. I assume the help desk will tell you if you jump through the hoops correctly.
While on campus, on your networked computer, logged in to the INTRA domain, you can change your password by CTRL-ALT-DEL and then selecting the Change Password button. This is the method that I prefer.
If you change your intra password in a way that does not also change it on your networked computer, you may not be able to log on with the networked computer until you also change it on that computer. I have been told that this is not supposed to happen, but it has happened to me on more than one occasion. On a few occasions I changed my INTRA password via CTRL-ALT-DEL / Change Password while logged in to INTRA on my office PC. Then I tried to log in to INTRA with my laptop. It would not accept my new password or my old password. I was able to resolve this problem in the following way: I booted up the laptop while it it was not networked (I removed the network cable and logged in with my old password), then I plugged in the network cable and changed the password to the new password. More recently I changed my password with the self-service system while logged in on my desktop PC. The laptop would not allow me to log in to INTRA with either the new or the old password (I could log in with the old password and the network cable unplugged) and then it locked my account out.

New to ECU?

If you are a new student, the University should snail-mail to you the information you need to get started using University network resources. If they do not, call the help desk at 9866.
If you are a new faculty member, the Center for Faculty Excellence will get to you by I know not what means the information you need to get started using University network resources.

Got a Laptop With Wireless?

If your laptop is configured to logon to domain INTRA it will do so when you log into Windows IF it is connected to the network through a network cable but not otherwise. If you have not plugged in the network cable, it will still let you logon as if you were logging into the intra domain, but you don't actually get into that domain until you go through the connect2ecu wireless network authentication page. Accordingly, if you use another computer to change your intra password through the self service system, your laptop does not know that this change has taken place. When you later try to logon to Windows on your laptop it will not accept the new password, it will only accept the old password. Furthermore, it will not allow you to change the password. You seem to be stuck with the old password for getting into Windows and then the new password for logging in to the wireless network. Also, it will lock your userid and then you will not be able to logon your intra account from any computer until you use the self service program to unlock your password -- and you will have to find a way to access the self service program without using your ECU internet connection -- for example, go home and use your home computer and ISP.

The only way around this SNAFU of which I am aware is this:

After you have changed your intra password with the self service facility, attach your network cable (on campus) to your laptop -- if you have a networked desktop computer, remove the cable from it and plug it into your laptop.
Boot up the laptop, and use the new password to log on.
Windows will remember the new password.

I am guessing that if you change your password from your laptop while it is connected to intra, Windows will remember the new password -- but maybe not if you are connected by wireless ???

How Do I get PGP Software to Encrypt My Documents?

See http://core.ecu.edu/psyc/wuenschk/Help/PGP.htm

How Do I Use PGP Software to Encrypt My Documents?

You could just RTFM, but, trust me, it is a bit too technical for most folks. Just follow my simple instructions here.

After you have installed the software, just point at the file you want to encrypt, click the right mouse button, and then select from the drop down menu PGP, Encrypt. In the resulting dialog box, check Wipe Original, Conventional Encryption, and then click OK.

Enter and then confirm your PGP password.

To decrypt a PGP file, point at it, click the right mouse button, and then select PGP, Decrypt & Verify. Enter your PGP password and click OK.

Do not forget to wipe the decrypted file once you are done with it. To wipe it, just point at it, right click, PGP, Wipe.

If you edit the file, do remember to encrypt it and then wipe the original after editing.

birds flying

Back to Karl's E-Mail Resources Page.

PGP Help File -- more details on how to use PGP to encrypt, decrypt, and wipe files.
Visit Karl's Index Page

Contact Information for the Webmaster,
Dr. Karl L. Wuensch

This page most recently revised on 30. June 2008.