Two-Step Login (Duo) FAQ

Overview

This page provides answers to frequently asked questions about two-step login (Duo) at the University of Oregon.

Table of Contents:

• How do I enroll my account in Duo?
• Who must enroll in Duo?
• What is two-step login?
• Where will I use Duo?
• How often will I need to use Duo?
• Can I preview two-step login before enrolling?
• Do I have to use a personal device?
• What if I can't use the Duo Mobile app?
• Do I need a smartphone or tablet?
• Do I need Wi-Fi or cell service?
• Where can I get a hardware token?
• Can I register more than one device?
• Why is the UO doing two-step login?
• What happens if I don't enroll?
• Will I have to register my laptop or desktop computer?
• I'm already using the Duo Mobile app for a non-UO service. Can I use it for UO, too?
• I'm having trouble with Duo. What can I do?
• Why does the Duo Mobile app want me to back up to Google Drive or iCloud?
• What happens if my device gets lost, broken, or stolen?
• What if I need help at night or on the weekend?

Information

How do I enroll my account in Duo? 

• Follow the instructions at Getting Started with Two-Step Login.

Who must enroll in Duo?

• All faculty, staff, GEs, and students and other affiliates like courtesy and associates must enroll in Duo.
• You will be prompted to enroll soon after claiming your Duck ID. 
• Once you've started using Duo, you'll be required to use it for as long as you have access to protected UO services, which may continue after you've left the university, depending on your UO affiliation.
• Emerit and retired employees who retired prior to July 29, 2020, aren't required to use Duo at this time.

What is two-step login?

• Have you ever gotten a verification code on your phone while logging in to online banking, email, or social media? That's two-step login!
• It goes by many names, including two-step verification, multi-factor authentication, and 2FA.
• Whatever the name, it combines something you know (your password) with something you have (like your phone) to make it much harder for cybercriminals to break into your account.

Let the Duck explain:

Where will I use Duo at UO?

• Services protected by two-step login include:
  • UO web services that use Shibboleth single sign-on for login, including Canvas, Zoom, Banner, and others
  • UOmail
  • Office 365 applications, including Microsoft Word, Teams, Outlook, OneDrive, and others
• For more information, see List of UO services protected by Duo.
• More services will be protected by two-step login in the future, including UO VPN and others.

How often will I need to use Duo?

• For most services, you can check the Remember me for 7 days box on the Duo screen. Then you'll only need to do two-step login once per week (for each browser or app, on each device).

Do I have to use a personal device?

• If you have a smartphone or tablet, we strongly encourage you to register it with Duo, because these devices can run the Duo Mobile app.
• We recommend using the Duo Mobile app from Duo Security has because it provides:
  • The best user experience;
  • The most ways to login from one device;
  • A built-in backup option: you can generate mobile passcodes and write them down to use later.
• Members of the UO community who have no devices available can receive a hardware token free of charge.

What if I can't use the Duo Mobile app?

• To run the Duo Mobile app, you'll need to have at least Android 7.0 or iOS 11.0.
• If you're not able to upgrade your smartphone sufficiently, you can still receive passcodes via text message (SMS) or receive phone calls from Duo (you answer and press 1 to log in). To register your phone this way, just start the registration process, choose “Mobile Phone,” and then for phone type, choose “Other.”

Do I need a smartphone or tablet?

• No. Here's how to get started with several other device options:
  • Non-smart cell phones, such as flip phones: You can receive passcodes via text message (SMS) or receive phone calls from Duo (you answer and press 1 to log in). To register your phone this way, just start the registration process, choose “Mobile Phone,” and then for phone type, choose “Other.”
  • Landlines: Follow our Duo registration guide for landline phones.
  • Hardware tokens: If you have no other options, you can pick up a small hardware device called a token from the Eugene campus. Please read about hardware tokens for Duo.

Do I need Wi-Fi or cell service?

• No. There are two methods that work without Wi-Fi or cell signal.

Where can I get a hardware token?

• You can find instructions to receive your own hardware token at About hardware tokens for Duo.

Can I register more than one device?

• Yes. In fact, we recommend it! That way you'll have a backup if your first device isn't available.
• Pro tip: Did you know the Duo Mobile app can generate passcodes you can use to log in later, like a backup method? This is recommended for everyone, but particularly for those who don't have a second device to register.

Why is the UO doing two-step login?

• Phishing and identity-theft crimes are on the rise in higher education.
• In response, the University of Oregon is partnering with Duo Security to implement two-step login.
• Two-step login helps safeguard your account against breaches and other cybercrime, even if your password gets stolen. It does this by requiring for two factors when you log in to protected services: something you know (your password), plus something you have (like your phone).
• By enrolling you in two-step login, we're making it much harder for anyone else to access or use your account maliciously, even if they were to steal your password. Multifactor authentication, such as two-step login with Duo, blocks almost 100% of attacks based on credential theft, according to research by Google and Microsoft.
• Once you've registered your first device with Duo, you'll have the ability to deny access if someone else is trying to sign in as you to a protected UO service. You can press "Deny" on a Push notification, or press 9 during a Duo phone call, to report a fraudulent attempt to use your account.

What happens if I don't enroll?

• If you do not enroll ahead of time, you will be prompted to do so the first time you try to use any protected UO services. Here's what you can expect:
• After you enter your UO username and password, a new prompt from Duo Security will appear, entitled Protect Your University of Oregon Account (screenshot below).
• If you click the green Start setup button, you will be walked through the process of registering a phone or tablet.
• Alternatively, you can follow the instructions at Getting Started with Two-Step Login to register a device.
• Once you've registered a device, you can complete your login to access the protected service.

Will I have to register my laptop or desktop computer?

• No. For two-step login, you will register a cell phone, hardware token, or landline phone.

I'm already using the Duo Mobile app for a non-UO service. Can I use it for UO, too?

• Yes. The Duo Mobile app can be used for multiple services at the same time. Just register that same smartphone or tablet for UO's two-step login (see Getting Started with Two-Step Login).
• The app will work for two-step login for your Duck ID and will also continue working for any other services you're using Duo for.

I'm having trouble with Duo. What can I do?

• Check out our self-help articles in the knowledge base.
• Contact the Technology Service Desk.

Why does the Duo Mobile app want me to back up to Google Drive or iCloud?

• Allowing the Duo Mobile app to back up to Google Drive or iCloud will turn on Duo Restore for your account.
• This feature makes it easier to recover your Duo settings if you later replace your phone.
• This option is mentioned in our best-practice recommendations. More information is available on Duo's website.

What happens if my device gets lost, broken, or stolen?

• Report it. Lost or stolen devices should be reported to the Technology Service Desk immediately to prevent unauthorized access to protected resources.
• Use a backup option, if you have one:
  • Use another registered device. If your usual device is unavailable for some reason and you've registered other devices, you can use those. After you enter your Duck ID and password to log in, when you get the Duo prompt, just use the drop-down menu at the top to select an alternative device.
  • Use mobile passcodes. Did you previously generate mobile passcodes from the Duo Mobile app and write them down? You can use them like a backup device!
• Request a temporary bypass code, if needed. If you don't have any other devices registered, you can request a temporary bypass code. 

What if I need help at night or on the weekend?

• The Technology Service Desk has extended service hours.