Never share your login

• A password must be strong. Make sure that it is not easy to guess your password.
• A password should not contain personal information. Many people use birth dates, names, addresses and similar as passwords, but they are relatively easy to guess for people with sinister intentions.
• You can create and remember a password based on a sentence or a passphrase, for example.

Password based on sentences

• It is easier to remember a sentence than a random order of letters, numbers, special characters, etc. You can use this to create a password as a number of characters based on a sentence. For example, Lauritz has been rector of Aarhus University for more than four years. This sentence can be translated into the following password: LhbRoAU>4yrs.
• Without the sentence, this password would probably be almost impossible to remember, but the sentence makes it very easy to remember.
• You can expand the system, for example by replacing specific letters with numbers or special characters. E.g. $ instead of S.

Password = passphrase

• You can also use passphrases as your password. These are whole sentences used as passwords.
  For example, Peter has 1 yellow Volvo, but it looks brown. 
• This passphrase is a good example because it is relatively easy to remember, fairly complex, difficult to guess and so long that trying to guess it would be impossible.
• The downside is that not all systems support passphrases. 
• You can often work around this by removing "spaces" and other not "normal" characters, so the sentence instead looks like this Peterhas1yellowVolvo,butitlooksbrown.
• If it is possible to use passphrases, be careful not to use passphrases that are "easy" to guess, for example "Old MacDonald had 1 farm". Famous quotes and songs, etc. are probably already on the hackers’ passphrase lists, making them easier to guess.

The system uses two-factor authentication to check whether it is actually you who is trying to log in to your account. You will typically be asked to confirm your identity using your mobile phone. In practice, this is the only effective way to prevent others from impersonating you online. Almost all logins with an AU account now use two-factor authentication, but in some cases, it is still just an option. 

For your own and the university’s sake, we recommend that you activate two-factor authentication for your private email account, social media accounts and all other accounts that require you to log in with a password. Your identity is a gateway to both personal and sensitive information, and you can keep this information safe by using two-factor authentication.

See how to activate two-factor authentication on AU systems in this guide.

See also how to enable two-factor authentication on a number of popular services at sikkerdigital.dk. (In Danish only.)