Two-Step Login (Duo) FAQ

Overview

This page provides answers to frequently asked questions about two-step login (Duo) at the University of Oregon.

Table of Contents:

Information

How do I enroll in two-step login (Duo)?

Will two-step login start as soon as I enroll?

  • You'll start seeing prompts from Duo within one day of registering your first device.

What is two-step login?

  • Have you ever gotten a verification code on your phone while logging in to online banking, email, or social media? That's two-step login!
  • It goes by many names, including two-step verification and multifactor authentication.
  • Whatever the name, it combines something you know (your password) with something you have (like your phone) to make it much harder for cybercriminals to break into your account.

Where will I use Duo at UO?

  • Services protected by two-step login include:
    • UO web services that use Shibboleth single sign-on for login, including Canvas, Zoom, Banner, and others
    • UOmail
    • Office 365 applications, including Microsoft Word, Teams, Outlook, OneDrive, and others
  • For more information, see List of UO services protected by Duo.
  • More services will be protected by two-step login in the future, including UO VPN and others.

How often will I need to use Duo?

  • For most services, you can check the Remember me for 7 days box on the Duo screen. Then you'll only need to do two-step login once per week (for each browser or app, on each device).
  • Note: Banner is different. For the best performance of Banner 9, we recommend using private browsing — specifically, running Banner in a Chrome Incognito window and closing that window at the end of each business day. For that reason, Banner users will need to do two-step login at least once on each day they use Banner.

Can I preview two-step login before enrolling?

  • Yes, through our video learning series.
  • The brief "Preview" video from Duo Security provides a quick demo.
  • Video 02 ("Demo of the Duo experience") shows what it's like to use Duo with a single sign-on service at the UO.

Do I have to use a personal device?

  • If you have a smartphone or tablet, we strongly encourage you to register it for Duo, at least temporarily.
  • In particular, we recommend using the Duo Mobile smartphone app from Duo Security because it provides:
  • Although other device options exist, they're better suited to UO's normal campus operations, when many faculty and staff have an office phone handy and it's easier for campus IT staff to distribute hardware tokens.
  • For people who are reluctant to use a personal device for two-step login on a routine basis, you can register your device once, then subsequently write down some passcodes yourself, as described above, or request temporary emergency bypass codes. Once campus operations return to normal, you can register an alternative device and unregister your smartphone.

What if I can't use the Duo Mobile app?

  • To run the Duo Mobile smartphone app, you'll need to have at least Android 7.0 or iOS 11.0.
  • If you're not able to upgrade your smartphone sufficiently, you can still receive passcodes via text message (SMS) or receive phone calls from Duo (you answer and press 1 to log in). To register your phone this way, just start the registration process, choose “Mobile Phone,” and then for phone type, choose “Other.”

Do I need a smartphone or tablet?

  • No. Here's how to get started with several other device options:
    • Non-smart cell phones, such as flip phones: You can receive passcodes via text message (SMS) or receive phone calls from Duo (you answer and press 1 to log in). To register your phone this way, just start the registration process, choose “Mobile Phone,” and then for phone type, choose “Other.”
    • Landlines: Follow our Duo registration guide for landline phones.
    • Hardware tokens: If you have no other options, you can pick up a small hardware device called a token from the Eugene campus. Please read about hardware tokens for Duo.

Do I need WiFi or cell service?

Where can I get a hardware token?

Can I register more than one device?

  • Yes. In fact, we recommend it! That way you'll have a backup if your first device isn't available.
  • Pro tip: Did you know the Duo Mobile app can generate passcodes you can use to log in later, like a backup method? This is recommended for everyone, but particularly for those who don't have a second device to register.

Why is the UO doing two-step login?

  • Phishing and identity-theft crimes are on the rise in higher education.
  • In response, the University of Oregon is partnering with Duo Security to implement two-step login.
  • Two-step login helps safeguard your account against breaches and other cybercrime, even if your password gets stolen. It does this by requiring for two factors when you log in to protected services: something you know (your password), plus something you have (like your phone).
  • By enrolling you in two-step login, we're making it much harder for anyone else to access or use your account maliciously, even if they were to steal your password. Multifactor authentication, such as two-step login with Duo, blocks almost 100% of attacks based on credential theft, according to research by Google and Microsoft.
  • Once you've registered your first device with Duo, you'll have the ability to deny access if someone else is trying to sign in as you to a protected UO service. You can press "Reject" on a Push notification, or press 9 during a Duo phone call, to report a fraudulent attempt to use your account.

Who must enroll in Duo?

What happens if I don't enroll by the deadline?

  • In that case, here's what you can expect the first time you try to use any protected UO services. After you enter your UO username and password, a new prompt from Duo Security will appear, entitled Protect Your University of Oregon Account (screenshot below).
  • If you click the green Start setup button, you will be walked through the process of registering a phone or tablet.
  • Alternatively, you can follow the instructions at Getting Started with Two-Step Login to register a device.
  • Once you've registered a device, you can complete your login to access the protected service.

Screenshot of Duo Security prompt to register a device for two-step login

Will I have to register my laptop or desktop computer?

  • No. For two-step login, you will register a cell phone, hardware token, or landline phone.

I'm already using the Duo Mobile app for a non-UO service. Can I use it for UO, too?

  • Yes. The Duo Mobile app can be used for multiple services at the same time. Just register that same smartphone or tablet for UO's two-step login (see Getting Started with Two-Step Login).
  • The app will work for two-step login for your Duck ID and will also continue working for any other services you're using Duo for.

I'm having trouble with Duo. What can I do?

Why does the Duo Mobile app want me to back up to Google Drive or iCloud?

  • Allowing the Duo Mobile app to back up to Google Drive or iCloud will turn on Duo Restore for your account.
  • This feature makes it easier to recover your Duo settings if you later replace your phone.
  • This option is mentioned in our best-practice recommendations. More information is available on Duo's website.

What happens if my device gets lost, broken, or stolen?

  • Report it. Lost or stolen devices should be reported to the Technology Service Desk immediately to prevent unauthorized access to protected resources.
  • Use a backup option, if you have one:
    • Use another registered device. If your usual device is unavailable for some reason and you've registered other devices, you can use those. After you enter your Duck ID and password to log in, when you get the Duo prompt, just use the dropdown menu at the top to select an alternative device.
    • Use mobile passcodes. Did you previously generate mobile passcodes from the Duo Mobile app and write them down? You can use them like a backup device!
  • Request a temporary bypass code, if needed. If you don't have any other devices registered, you can request a temporary bypass code. You can then use that code to access services and to register more devices in Duck ID Self-Service.

What if I need help at night or on the weekend?