Back on topic.... Re: [SECURITY] University credentials used by third parties

["Flynn, Gary - flynngn" <flynngn () JMU EDU>]

In the terms and conditions Ultrinsic says, " Access to School Account. By
providing Ultrinsic with your username and password for your online school
account, you authorize Ultrinsic to access the account and to view and
record any information in your account."

If the university AUP prohibits revealing credentials to third parties, does
a student have the legal authority to authorize Ultrinsic to access the
university system? And if not, wouldn't this be unauthorized access of a
university system by Ultrinsic with attendant legal repercussions,
particularly at state universities? A disclaimer on login pages could
reinforce this. For example,
> ³For interactive use by university students, employees, registered affiliates,
> and alumni only. All other use and access prohibited. Violators will be
> prosecuted.²

How would one go about blocking Ultrinic's access to your student
information system? The address they use for their web site might not be the
same one they use to source logins to your student system. It might turn
into a case of whack-a-mole.

This kind of thing furthers the argument for more widely mandated
certificate or 2-factor based authentication to all Internet exposed
services that are access controlled...even self-service ones. In this case,
more as an enforcement AUP restrictions on giving out authentication
credentials than of any type of hacking.