Be wary of any program or web page that asks you for your username and password.
University web pages that ask you for your username and password will generally begin with "https://shib.york.ac.uk/" or "https://www.york.ac.uk/".
Remember to close your web browser after using any secure services, especially if you are using a shared or public computer.