2FA - Two Factor Authentication

Security at UDE

Members of the university are exposed to online attacks on a daily basis. The attackers’ aim is to gain access to sensitive information and, by infecting systems with Trojans, to lay the groundwork for further attacks on the UDE network. In so-called phishing attacks, the aim is to trick victims into revealing their login details (username and password). With these, the attackers gain access to the university’s network and applications.

For this reason, protecting access with a password alone is not considered secure. Multi-factor authentication has now become the standard practice. In this process, in addition to the password (the ‘knowledge’ factor), the user provides a further factor from the ‘possession’ or ‘biometric’ categories. This can be done, for example, via an app on a smartphone, a USB token or a fingerprint sensor.

A summary of multi-factor authentication can also be found on the website of the Federal Office for Information Security at https://www.bsi.bund.de/dok/11693908

 

Two Factor

At the University of Duisburg-Essen, two-factor authentication will be required to access the network from the internet and to access other highly secure network areas. Furthermore, two-factor authentication may be required to access other services. The ZIM provides standardised interfaces for this purpose, which any service provider at the university can use.

TOTP

Initially, the TOTP method will be used. This involves generating a time-based secret via an app, such as Google Authenticator or freeOTP, or a TOTP device (such as the Reiner sct Authenticator), which is then requested as an additional step during login.

Passkey

Passkeys are a simple and secure alternative to passwords. To use a passkey, you need a compatible device on which it is registered and used.
 

Requirements

The following requirements must be met to register a passkey:

  • PC: Windows 10 or later
  • Mac: macOS Ventura or later
  • Apple: iOS 17 or later
  • Android: Android 9 or later

Procedure

The passkey is stored in the encrypted section of the device and can only be unlocked for use via a biometric feature or a PIN.

Login takes place on the user’s passkey device, and there is no need to enter the account password. Depending on the device, a biometric feature or a PIN will be requested to unlock the passkey.

Furthermore, the passkey can only be used to log in on the university’s websites and is therefore protected against phishing.

Help with setup