Keeping your Virtual University credentials safe when using automation tools
What to check before you give any third-party tool your Virtual University LMS login, and how encryption at rest actually works.
Any tool that checks your LMS on your behalf needs to sign in as you, which means handing over your Virtual University credentials. That is a real trust decision and it deserves more scrutiny than it usually gets.
Questions worth asking
- Is the password encrypted at rest, or stored as plain text?
- Who can decrypt it — only the automation, or any staff member?
- Is the connection to the LMS over HTTPS?
- Can you revoke access and delete the stored credential?
What encryption at rest means
VU Learning encrypts your LMS password with AES-256 before it is written to the database. The stored value is ciphertext plus an initialisation vector; without the separate encryption key it is not readable, including by anyone with database access alone.
Basic hygiene either way
Use a password for the Virtual University LMS that you do not reuse anywhere else — particularly not your email. That way the blast radius of any breach, anywhere, stays contained to one account.
Keep reading