Passwords are increasingly easy to compromise. They can often be stolen, guessed, or hacked — you could be locked out of your account, or you might not even know someone is accessing it. 

Two-factor authentication (2FA) adds a second layer of security, keeping your account secure even if your password is compromised. With 2FA, you will be alerted right away if someone is trying to log in as you. 

This article describes what Two-factor Authentication (2FA) is, why the University of Waterloo uses it and how to get started to enrol in 2FA. For complete information about 2FA at UWaterloo, please review IST’s two-factor webpage: https://uwaterloo.ca/two-factor-authentication/.

This article includes:

What is two-factor authentication?

Two-factor authentication (2FA), also known as multi-factor authentication, is the process of authenticating to an online service using something you know as the first factor (i.e. a password) and something you physically have as the second factor. Traditionally, the second authentication factor would be a physical fob or token, with the most popular form having a six-digit display.

Why is Waterloo doing this?

Password-based attacks account for most of the cyber-attacks against the University. The COVID-19 pandemic has resulted in a dramatic increase in phishing attacks against UW, and because people frequently re-use passwords, breaches at other sites can still impact the University because of a related attack called “credential stuffing”. In short, the password alone is obsolete. Stronger authentication is required for services on the public Internet. See:

• https://www.ctvnews.ca/politics/cra-cyberattacks-impacted-four-times-as-many-accounts-as-previously-believed-1.5109368

• https://uwaterloo.ca/information-systems-technology-newsletter/fall-2020/feature/identity-fraud-brought-you-your-inbox

How to enroll and authenticate with 2FA

The preferred second-factor option is the Duo Mobile app 

• The app is available for iOS and Android devices, with or without cellular access 

• While an Internet connection is required for adding the device to a user’s Duo account, the app can be used to generate OTP codes even when cellular data or Wi-Fi networks are not available 

• The app is simple to register and use. It functions in various modes, with or without cellular data or Wi-Fi connection 

• Any Duo-protected application can be authenticated with the app. It is not necessary to disclose the phone number for a smartphone to use the app 

System requirements

Download the Duo Mobile app onto your mobile device

From your app store install the “Duo Mobile” app by Duo Security

• Duo Mobile for Android

• Duo Mobile for iOS

Enroll the device

Using the Duo Push option

1. Visit  Device management

2. Authenticate with your 8-character username @uwaterloo.ca (e.g. j25rober@uwaterloo.ca) and password

3. Click Next on the three welcome and informational pages.
   

   

4. Select Duo Mobile.

    

   

5. Skip entering a phone number by selecting I have a tablet
   

   

6. If you haven’t already, install the Duo Mobile app and click Next.
   

   

7. Use the Duo Mobile app to scan the QR code and add your account to the app.
   

   

   
   

8. Click Continue.

   

9. Log out and close your browser.

Authenticating

The guide below shows how to log in to a 2FA-protected service using DUO.

1. Log in to the service with your 8-character UWaterloo username@uwaterloo.ca (e.g. j25rober@uwaterloo.ca) and password

2. When presented with the DUO prompt, click Send Me a Push.

3. In your browser, a verification code will display.

4. On your smartphone, enter the verification code when prompted and select Verify or I’m not logging in as appropriate.

Additional resources for enrolling in 2FA

Where is that push coming from?

When you receive a 2FA push notification on your phone, it will display the geographic location the access is coming from. Looking at this before approving the prompt provides an extra level of assurance that you are approving the correct login. If the location is incorrect or you are not actually logging in to a 2FA-protected service, you should deny access and report it as suspicious. See also, What do I do with an unexpected 2FA notification?

Related articles