Frequently Asked Questions About Two-Factor for Weblogin

The expenses related to the Duo options are mostly low-cost or no-cost. If you need assistance, contact the ITS Service Center so we can connect you with the best low-cost or no-cost option for you.

No. If you access online resources protected by U-M Weblogin when you are away from the university, you will need to use one of the multiple options that Duo offers.

No. Duo is a high-performing, Ann Arbor-based company, owned by Cisco Systems. Besides the fact that the company was founded by Michigan alums, which is a plus, many of our peer institutions are successfully using the two-factor tool.

Duo provides faculty, staff, and students with the most options for individual choice (that is, mobile app, passcode, landline, YoubiKey, or hardware token), while protecting university data and your personal information.

No. In fact, the reverse is true. Successful attacks on peer universities not using two-factor have been costly in terms of time, reputation, and resources. The cost of using Duo is significantly less than the potential cost of a serious data breach. 

Yes. Hardware tokens do have a cost to the university, but you can get an initial token free of cost from the U-MTech Shop. Visit the Tech Shop to explore your options. Individuals can purchase additional or replacement hardware tokens themselves (need-based exceptions are considered on a case-by-case basis).

Contact the ITS Service Center to request a temporary bypass code to log in.

Duo offers multiple options. You do not need to own a smartphone. Although the majority of people find having the Duo Mobile app on their smartphone or tablet to be the most convenient option, it may not work for everyone. Duo offers multiple options for different circumstances and needs, including using a basic cell phone, landline, hardware token, or YubiKey.

No. To better protect university systems and data, it is important that all students, staff, and faculty use two-factor for Weblogin.

The "Yes, this is my device/Remember me" option is the maximum length of time that U-M allows Duo two-factor to be remembered, provided you are using the same device, same web browser, and your browser does not block cookies. Remember me is optional, and the length of time cannot be changed. If you clicked Yes, this is my device and want to undo it before the seven days are up, delete your browser cookies.

The Duo app uses about 32 MB of internal storage on an Android device and 28 MB on an iPhone. For reference, that is the same size as about four digital pictures taken with your device's camera.

No. Duo does not offer a computer app, which means you will need a separate device—such as a phone, tablet, hardware token, or YubiKey.

U-M students, staff, and faculty can choose to use as many Duo options that work best for them, although some schools, colleges, or units may have their own preferences or guidelines.

Available options:

• App for your mobile device that offers a "push" notification or passcodes (recommended)
• Passcodes via text message
• Phone call-back
• Duo hardware token (available at the U-M Tech Shop)
• YubiKey (available at the U-M Tech Shop)

For details, see Options for Two-Factor Authentication.

Yes and no. U-M pays per-authentication charges when a phone call (or text message) is used. And while there is no cost to you when using a university landline, your phone plan’s rates would apply if you’re using a personal landline.

Duo hardware tokens and Yubikeys are available from the Tech Shop. The university will cover the cost of an initial hardware token or YubiKey for individuals. Individuals can purchase additional or replacement hardware tokens or YubiKeys themselves (need-based exceptions are considered on a case-by-case basis).

Your hardware token may be out of sync when the login screen displays “Incorrect passcode. Please try again.”

You can re-sync a hardware token by generating a new passcode three more times and entering each of the three passcodes on the Duo prompt. On the third entry, you should be logged in successfully.

Your hardware token may be out of sync when the login screen displays “Incorrect passcode. Please try again.”

When you enroll, you will be adding an account. You will see a U-M account in your Duo app.

It is best to check with your instructor before the exam to determine how they would like to address this matter for your particular class.

One of the easiest options, assuming you have the Duo Mobile app, would be to use the Duo login screen shortly before the exam and send yourself a text message with apasscode. Write it down and take it into class. Again, it is a good idea to check with your instructor first to make sure they are okay with this option.

Text message passcodes are good when used within 30 days.

• If you get a new phone with the same number, you need to install the Duo Mobile app on your new phone and reactivate the app. Follow the steps in Manage Your Duo Devices. Note: Before you sell or give away your old device, back it up and then erase all content and settings.
• If you get a new phone with a new number, you can add it as an additional device. Follow the steps in Manage Your Duo Devices.

No. It usually takes only a few extra seconds to enter a passcode or to approve a notification on your phone. Additionally, Duo has a “Remember Me” function, so you aren’t prompted to use two-factor every time you log in.

No. Within the Duo Mobile app, you can generate a passcode that doesn’t require connectivity. More information is available on the Safe Computing website. We encourage you to plan ahead before your trip and choose something that will work for you.

Yes. You likely have access to more than you think, including information that can be of great value to attackers. If your account is compromised, it is a foot in the door that can be used to spread attacks elsewhere at U-M.

For instance, your email account could be used to spread phishing attacks to your contact list. Shared files to which you have access could be infected, so that other users who access those files could have their accounts compromised. Or your account could be used to log into various university systems. We encourage you to not underestimate the valuable assets to which you hold the keys.

No. Higher education institutions are known to be a big target for cyber criminals, particularly universities where a significant amount of research is done. Universities house a great deal of sensitive data of value to cyber criminals and, by their nature, have an open-access, decentralized environment. 

No. U-M's intent is to provide a safe and secure online environment, so that no one can spy on or steal from the institution or its employees.

Contact the ITS Service Center or HITS Service Desk. They can provide an emergency bypass code.

The ITS Service Center or HITS Service Desk are available to provide assistance and support, and answer questions you have about Duo.