Two-Step Login (Duo) Project

UO does Duo

This project is a phased effort to enroll all UO faculty, staff, and students in two-step login by Duo Security.

Project Status

UO Groups Duo Enrollment Status
IT staff Completed 2019
Banner users and other employees with access to high-risk data Completed 2019
All employees
  • Faculty
  • Staff
  • Graduate employees
  • Student employees
In Progress (February 2020)
  • Currently voluntary
  • Mandatory deadline TBA
All students Future

How Does Duo Work?

Three-part graphic: Step 1 is a laptop labeled Duck ID and password, step 2 is a cell phone labeled Prove it's you, and step three is a checkmark labeled Secure access.

  • First you'll register a mobile phone, tablet, desk phone or small hardware token. Instructions: Getting Started with Two-Step Login.
  • Within a day, two-step login will go into effect for your Duck ID account.
  • From that point on, when you log in to CanvasMyTrackConcur, or any other UO website that uses Shibboleth single sign-on — that familiar "Login Required" screen — Duo will prompt you to confirm your identity using the device you've registered.
  • Using the Remember me for 7 days option, most people will only have to do that verification step once per week (per browser, per device).

 

Screenshot of UO's green-and-yellow Login Required screen (Shibboleth single sign-on).
UO's "Login Required" screen for Shibboleth single sign-on.

 

Why Two-Step Login?

Two-step login is a critical part of our strategy to fortify UO's defenses against cyberattacks, enabled by strategic funding approved in May 2019.

  • Universities around the world, including the UO, are high-priority targets for hackers. An example is the phishing attack of August 2018.
  • Stolen UO credentials can be leveraged to gain unauthorized access to personal information, research data, and intellectual property.
  • Multi-factor authentication blocks almost 100% of attacks based on credential theft, according to research by Google and Microsoft.

Enrolling in Duo: When and How

Now: Voluntary

  • Enrollment for UO employees is currently voluntary but strongly encouraged.
  • You can enroll yourself. Instructions: Getting Started with Two-Step Login.
  • You may be contacted by IT staff in your area asking you to enroll during a particular time frame in winter or spring term.
  • Trainings and enrollment sessions will be offered by Information Services and other UO IT staff (details TBA).

Coming Soon: Mandatory

  • In the next couple of months, we'll announce a deadline for enrolling in Duo.
  • After that date, Duo will be mandatory. You won't be able to log in to CanvasMyTrackConcur, or any other UO website that uses Shibboleth single sign-on without enrolling in Duo.

Future

  • Duo isn't yet available to students who aren't UO employees.
  • Non-employee students will be included in a future phase of this rollout.

Instructions and FAQs

The UO Service Portal contains a lot of information about two-step login. We suggest starting here:

More Information

Around the O stories about this project:

Two-step login for UO employees was also announced in an email from CIO Jessie Minton (2/19/20).

Contact Us

If you have questions about the Two-Step Login Project, please contact the project team at twostepproject@uoregon.edu.

For tech support: