New Multi-Factor Authentication Enhancements

We encourage you to familiarize yourself with the Verified Duo Push screen. Once risk-based authentication is turned on, Duo may present you with a different screen.

We do! Share our flyers for moving onto the Duo Mobile App - available in English | Spanish | Simple Chinese

You can request a security key–or buy your own. We recommend several options on the security key page. Just keep in mind that you will only be able to authenticate using those physical keys. So, if you lose the key, you'll need another method in place.

You cannot sign into campus systems using SMS text messages or simple hardware tokens. When you try logging into CalNet, you will be asked to select "manage devices" to add another method in the mycalnet.berkeley.edu portal - to Duo Mobile App, Security Key, or Bypass codes.

This method is approved under the new enhancements. It works by storing your private key safely on your device and allows you to sync your passkeys across different devices within a platform's ecosystem, such as LastPass, iCloud Keychain, or Google Password Manager.

This method is approved under the new enhancements. However, you will only be able to authenticate using that physical device. So, if you plan on traveling and not taking your computer, it's best to use Duo Mobile or to print bypass codes.

Duo collects two types of information from you. The first type pertains to your authentication attempts; this information is always sent and cannot be turned off. The second type is analytical data, which you can choose to disable. To stop sending your analytical data to Duo, open the app, go to Settings, and turn off the option for sending usage data. Learn more about data privacy with Duo Push.

Risk-based authentication (RBA) is a method that assesses the risk of a login attempt and adjusts the security measures accordingly.

Risk-Based Factor Selection: Looks at authentication requests and adjusts security measures based on risk. It learns what “normal user behavior” is and spots patterns that may indicate an attack. If it detects a known attack pattern or unusual activity, the person will be prompted to use the most secure method, like Verified Duo Push.

Verified Duo Push Selection Methods: Requires users to enter a numeric code from their mobile device authentication prompt, adding an extra layer of security by requiring interaction with both the access and the authentication devices (e.g., phone and computer, tablet and computer).

Risk-Based Remembered Devices: Checks for logins from unusual network locations. If it finds a suspicious login, it ends the remembered device session, and users must log in again. It looks at the last 30 days of successful authentications to determine activity.

Risk-based authentication (RBA) checks your login attempts for signs of push harassment and other threats. It may automatically increase your security methods depending on the potential threat level at the time of login. Verified Duo Push is one of these methods. It requires you to enter a unique code displayed on your computer or device into the Duo Mobile app.

RBA enhances security by:

• Preventing accidental approvals and blocking unauthorized access.
• Dynamically adjusting authentication requirements based on observed risk factors.
• Improving the user experience by only asking for additional verification when necessary.