Tufts Password Policy

February 28, 2013

The Tufts Username and Tufts Password are contemporary credentials provided centrally to individuals and maintained to help the community manage access to business critical, regulated, personal, private and other forms of information in the University. All systems at Tufts are encouraged to use The Tufts Username and Tufts Password authentication service. 

The Tufts Username lets systems and applications at Tufts know who you are.  Most Usernames are the first letter of your first name, and up to the first five letters of your last name followed by two numbers.

The Tufts Password is issued confidentially to individuals. It enforces the criteria outlined below.

Policy:
All University Systems should use the Tufts Username and Tufts Password system. While some business tools may require additional security, none should use a standard lower than what is expressed here. Systems that do not comply with the Tufts Username and Tufts Password standard should use all available techniques, and compensating controls. Legacy systems must use The Tufts Username and Tufts Password IdM system when they are suitably upgraded or finally replaced.

Standard for The Tufts Username and Tufts Password:

  • Maximum age (180 days) The maximum number of days that The Tufts Password can be used before it can be changed.
  • Minimum age (0 days) The minimum number of days that The Tufts Password must be used before it can be changed – permits “same day” changes, if needed.

Passwords must contain the following:

  • Minimum password length: 8 characters (can contain more)
  • Passwords cannot contain parts of your account name or your full name that exceed two consecutive characters
  • Password history: 5 (your previous 5 passwords are invalid and cannot be re-used)
  • Passwords must contain characters from at least three of the following four categories:
    • English uppercase alphabet characters (A–Z)
    • English lowercase alphabet characters (a–z)
    • Base 10 digits (0–9)
    • Non-alphanumeric characters ( !@#$%^&*()-_+=;:´"}{[]|\`~))

Don’t use Tufts passwords for outside accounts

Consider the risks of disregarding this advice and using your Tufts password for your non-Tufts accounts. Passwords are stolen frequently and then cycled instantly to cause trouble and commit crimes; this can work both ways against you as well as against Tufts.