Password Management - Revision history

Wdhn2983: remove NIST statement

2026-06-15T21:19:54Z

remove NIST statement

Wdhn2983 at 18:01, 12 June 2026

2026-06-12T18:01:32Z

Wdhn2983 at 18:01, 12 June 2026

2026-06-12T18:01:17Z

Wdhn2983: Update notification of WA state standards changes, Simplified descriptions for clarity, Added a comparison table for quick reference, Edit to college recommendations, Evergreen Apple device/iCloud account usage

2026-06-12T17:58:03Z

Update notification of WA state standards changes, Simplified descriptions for clarity, Added a comparison table for quick reference, Edit to college recommendations, Evergreen Apple device/iCloud account usage

Greenea: /* List of Technologies and Tools That a User Might Consider */

2024-09-03T20:49:42Z

‎List of Technologies and Tools That a User Might Consider

Greenea at 20:46, 3 September 2024

2024-09-03T20:46:01Z

Greenea at 20:44, 3 September 2024

2024-09-03T20:44:24Z

Granadoc: Clarified that the cloud based database in Last Pass is stored in an encrypted format that is not visible to Last Pass employees.

2019-05-09T19:00:52Z

Clarified that the cloud based database in Last Pass is stored in an encrypted format that is not visible to Last Pass employees.

Greenea: /* List of Technologies and Tools That a User Might Consider */

2019-04-23T16:45:50Z

‎List of Technologies and Tools That a User Might Consider

Greenea: /* Higher Education Reference Pages */

2019-04-23T16:41:55Z

‎Higher Education Reference Pages

@@ Line 64: / Line 64: @@
 |}
 ==== Summary ====
-* Evergreen is aligning with Washington State and NIST-based password standards
+* Evergreen is aligning with Washington State password standards
 * Password managers are strongly encouraged to support secure practices

@@ Line 63: / Line 63: @@
 |Apple ecosystem; simple, no-cost option
 |}
 ==== Summary ====
 * Evergreen is aligning with Washington State and NIST-based password standards

@@ Line 42: / Line 42: @@
 ==== Recommended Password Managers ====
 The following tools are commonly recommended for Evergreen users. These recommendations are non-binding and do not constitute official endorsement or support. Additional details are available through the provided links.
-{|
+{| class="wikitable"
 !Tool
 !Best For

@@ Line 1: / Line 1: @@
-===What Is a Password Manager Tool?===
+=== Updated Password Requirements (Washington State Alignment) ===
-A password manager tool is software that helps users encrypt, store, and manage passwords.
+The Evergreen State College has updated its [https://helpwiki.evergreen.edu/wiki/index.php/Change_My_Evergreen_Account_Password password requirements] to align with Washington State security standards. These standards emphasize improving real-world security while reducing user burden.
-The tool also helps users create secure passwords and automatically log in to websites.
-===Who Might Use a Password Manager Tool, and Why?===
+=== Password Managers ===
-Users should employ unique passwords for each website or system to help minimize the impact
+With these updated requirements, users are encouraged to adopt a password manager to securely store and generate strong, unique passwords.
-from the breach of one website or system; however, most users cannot remember a separate
-password for many sites and tend to use the same password or write them on a sticky note
-attached to their computer. Additionally, organizations may have passwords that need to be
-shared across teams and want a secure method to do so. Password manager tools allow users to
-more securely manage many distinct passwords and automatically log them in to websites.
-===The Benefits of Using a Password Manager Tool===
+==== Why Use a Password Manager? ====
-Password manager tools enable users to create and securely maintain unique passwords for
+* Generates strong, random passwords
-websites and other systems without having to memorize or write them down.
-===Risks to Consider When Using a Password Manager Tool===
+* Reduces password reuse
-Special care should be taken to secure the password tool, as it will grant access to all passwords.
-The “master” password that grants access to the tool should be very strong and unique, and
-multifactor authentication should be used if possible. Additional considerations include
-whether you want your password management tool to store the passwords locally or in the
-cloud.
-===List of Technologies and Tools That a User Might Consider===
+* Securely stores and autofills credentials
-Below are two popular password manager tools that an end user might consider for use. Users should evaluate which tool works best for their
-unique purposes. Neither EDUCAUSE nor HEISC (or Evergreen) recommends a particular tool; users employ
-these at their own risk.
-* '''[https://1password.com/ 1password]''' does not share encryption keys with 1Password, but it provides a password strength
-indicator. The password database can be stored in Apple’s iCloud, through Dropbox, or locally
-on personal devices. Use across multiple devices is simple if stored in the cloud but more secure
-if stored locally. The iOS version can be configured to support Touch ID on compatible devices.
-* '''[https://keepass.info/ KeePass]''' does not share encryption keys with KeePass, but it provides a password
+* Helps comply with Evergreen and state security expectations
-strength indicator. The password database is not stored in the cloud. Use across multiple
+Strong password usage is one of the most effective protections against unauthorized access and cyberattacks.
-devices is a little more complex, as the user needs to maintain access to the private password
-database manually.
-===Higher Education Reference Pages===
+==== Browser Password Managers (Not Recommended) ====
-* [http://www.bu.edu/infosec/howtos/password-management/ Boston University]
+While convenient, the college does not recommend relying on browser-based password managers (such as Chrome, Edge, Firefox, or Safari) as a primary solution.
-* [https://protect.iu.edu/cybersecurity/safeonline/passphrases/vaults Indiana University]
-* [http://community.pepperdine.edu/it/security/password/passmgrs.htm Pepperdine University]
-* [http://www.purdue.edu/securepurdue/pswdManager.cfm Purdue University]
-* [https://security.illinois.edu/content/use-password-manager University of Illinois at Urbana-Champaign]
-* InCommon webinar: [http://www.incommon.org/iamonline Security Awareness for User Authentication: Passwords and Beyond] (October 9, 2013)
-'''Source:''' [https://library.educause.edu/resources/2015/7/password-managers Educause / HEISC]
+* Exposure to browser-based threats
 [[Category:Network]]
 [[Category:Security]]

@@ Line 23: / Line 23: @@
 ===List of Technologies and Tools That a User Might Consider===
-Below are three popular password manager tools that an end user might consider for use. In
+Below are two popular password manager tools that an end user might consider for use. Users should evaluate which tool works best for their
-addition, some vendors provide enterprise versions, which allow centralized control of all
-accounts within the organization. Users should evaluate which tool works best for their own
 unique purposes. Neither EDUCAUSE nor HEISC (or Evergreen) recommends a particular tool; users employ
-these tools at their own risk.
+these at their own risk.
 * '''[https://1password.com/ 1password]''' does not share encryption keys with 1Password, but it provides a password strength
 indicator. The password database can be stored in Apple’s iCloud, through Dropbox, or locally
@@ Line 37: / Line 35: @@
 devices is a little more complex, as the user needs to maintain access to the private password
 database manually.
 ===Higher Education Reference Pages===

← Older revision		Revision as of 20:44, 3 September 2024
Line 57:		Line 57:
	'''Source:''' [https://library.educause.edu/resources/2015/7/password-managers Educause / HEISC]		'''Source:''' [https://library.educause.edu/resources/2015/7/password-managers Educause / HEISC]
	[[Category:Network]]		[[Category:Network]]
		+	[[Category:Security]]

@@ Line 32: / Line 32: @@
 share the encryption key with LastPass, provides a password strength indicator, and performs
 additional password tests such as ensuring you’re not using the same password across multiple
-sites. However, the ease of use requires that the password database be stored in the cloud.
+sites. The ease of use requires that the password database is stored in the cloud, however it is stored in an encrypted zero knowledge format which means the contents are not visible to LastPass employees.
 Additionally, as a web-based tool, your password database is available to anyone with an
 Internet connection and your master password. For this reason, it is strongly recommended that