Re: Back on topic.... Re: [SECURITY] University credentials used by third parties

[Jesse Thompson <jesse.thompson () DOIT WISC EDU>]

On 08/24/2010 11:08 AM, Joel Rosenblatt wrote:
> Just to thorough another thought into this mix, does anyone prevent
> their students (or other users) from turning over their credentials to
> Gmail or Blackberry?
>
> We see lots of authenticated logins from these services - and if I were
> to come down hard on this Ultrinsic using our sharing of password policy
> (which we do have) I'm sure that this would amount to having to change
> our policy to - you can't share your credentials - except with (gmail,
> Blackberry, etc.)
>
> I really hate inconsistent enforcement of policies, so it's either
> change the policy or cut off everyone.

+1

Our help desk created end-user instructions for IMAP-syncing email 
accounts with Gmail, despite the fact that it completely violates 
password policy.  They did this specifically because they get flooded 
with "how do I save my email" requests when we deactivate email 
accounts, but other users take advantage of it as well.

Yet, when we propose the idea of officially embracing this 
Gmail-IMAP-sync option as a more reliable alternative to forwarding  - 
essentially treating Gmail the same as any other IMAP client - the idea 
is immediately shot down because it violates password policy.

Jesse
(an email admin at Wisconsin)

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature