Duo two-factor authentication overview and instructions

Passwords are increasingly easy to compromise. They can often be stolen, guessed, or hacked — you could be locked out of your account, or you might not even know someone is accessing it. 

Two-factor authentication (2FA) adds a second layer of security, keeping your account secure even if your password is compromised. With 2FA, you will be alerted right away if someone is trying to log in as you. 

This article describes what Two-factor Authentication (2FA) is, why the University of Waterloo uses it and how to get started to enroll in 2FA. For complete information about 2FA at UWaterloo, please review IST’s two-factor webpage: Two-factor authentication.

This article includes:

What is two-factor authentication?

Two-factor authentication (2FA), also known as multi-factor authentication, is the process of authenticating to an online service using something you know as the first factor (i.e. a password) and something you physically have as the second factor. Traditionally, the second authentication factor would be a physical fob or token, with the most popular form having a six-digit display.

Why is Waterloo doing this?

Password-based attacks account for most of the cyber-attacks against the University. The COVID-19 pandemic has resulted in a dramatic increase in phishing attacks against UW, and because people frequently re-use passwords, breaches at other sites can still impact the University because of a related attack called “credential stuffing”. In short, the password alone is obsolete. Stronger authentication is required for services on the public Internet. See:

• https://www.ctvnews.ca/politics/cra-cyberattacks-impacted-four-times-as-many-accounts-as-previously-believed-1.5109368

• https://uwaterloo.ca/information-systems-technology-newsletter/fall-2020/feature/identity-fraud-brought-you-your-inbox

Enroll in 2FA

• The preferred second-factor option is the Duo Mobile app: Enroll using mobile phone number

  • Video guide to enroll: https://guide.duo.com/universal-prompt#enrollment

• Add the Duo Mobile App to a tablet or cell phone without providing a phone number

• Add a Security Key

• Platform authenticator

Authenticate

Once enrolled in to a 2FA-protected service using DUO, this guide shows how to log in to a 2FA-protected service using DUO:Authenticating

Related articles