"Password leak at Elsevier"

[Steven Carmody]

Hi,

I received this local announcement this morning:

> Do you use resources such as Mendeley, ScienceDirect, Scopus, Evolve, Knovel, Embase, Reaxys, Engineering Village/Compendex, or ClinicalKey/Clinical Pharmacology?
> 
> If you created an account with Elsevier to access resources or journals, save searches, create lists of publications, or use Mendeley, your password has been exposed online. Change the password associated with that Elsevier account immediately. If you use the same password to access your Brown and/or Google accounts, change them as well at https://myaccount.brown.edu.

So, Brown has been bad. Our librarians decided some time ago that they 
didn't want to deal with Shib-controlled access to the online 
publishers; instead we wrapped Shib around EZProxy so they can use "IP 
address based access control", an approach they know, love and  understand.

Members of the campus community can create accounts (userid/password) at 
Elsevier and those other sites. It turns out that > 1,000 people have 
done this. Wow! (The local librarians tell me, tho, that Brown isn't the 
only campus in this pickle -- they pointed to a campus in the South 
Eastern US that's in the Sweet 16.)

There was an early Shib Use Case that described sending a persistent 
opaque identifier to these sites; the publisher would recognize the user 
across multiple sessions but wouldn't know who the person is. That was 
intended to avoid this exact situation.

Do any of these publishers support that model ? Is there any approach we 
can give to our users to help them avoid creating passwords at these sites ?

thanks in advance !