Two-Step Login FAQ

Two-step login is an added layer of protection when logging into websites and apps. The procedure is also known as multifactor authentication (MFA) or two-factor authentication (2FA).

You're likely already familiar with two-step login procedures. Anytime you're required to enter an additional passcode sent via text message, email or phone call is an example of two-step login. 

In short, going forward, two steps will be required to log in:

1. Enter username and password like normal
2. Verify identity via a smartphone app, phone call or passcode

We're deploying two-step login to VPN access and single sign-on (see images below). It’s important that we provide extra layers of security into remote university connections (VPN) and financial and other systems with sensitive information accessed via single sign-on. Other systems may be added in the future. 

Learn more about two-step login and:

• General single sign-on
• Office365
• VPN
• G Suite 

As of January 30, 2019, two-step login became required for faculty, staff and UC San Diego Health personnel use of following systems: campus VPN connections and single sign-on. Other systems will be added at future dates.

Student use was required starting October 16, 2019.

You have options! The easiest way is to install a free app on your personal or university-issued smartphone. When you enter your username and password, the app will generate a push notification. Tap the green check mark and you’re in!

If you're not inclined to use the smartphone app method, you can 

• Use the app on a tablet (iPad or Android)
• Authenticate via a phone call to a landline or mobile phone
• Use a token (contact the Service Desk at servicedesk@ucsd.edu or 858-246-4357 to request one)
• Enter a passcode via text message

For VPN connections, you'll need to complete two-step login each time you connect. 

For other applications, you can tell Duo to remember your machine for seven days. Therefore, you'll only need to complete the two-step process once a week. Note that the remember feature applies per machine. For example, if you choose remember me on your work computer, but log in later on your home computer, you'll still have to complete the two-step login procedure. This is not recommended for public or shared computers.

Registering a device takes less than two minutes and is a DIY process. Do so at the registration portal (https://duo.ucsd.edu). 

Detailed instructions are available; access this step-by-step enrollment guide (Support Portal) for help.

If you need further assistance, contact the Service Desk (servicedesk@ucsd.edu or 858-246-4357). 

1. The Duo app automatically displays a passcode that can be used even without an Internet connection. See image below. 
2. If you're not taking your mobile device, or don't normally use your mobile device for authentication, you can text yourself a batch of 10 single-use codes (Support Portal) (that don't have to be used in order).
3. Request a token (see image below) from the Service Desk at servicedesk@ucsd.edu or 858-246-4357.
4. If none of the above options meet your needs, contact the Service Desk.

1. Tap "Deny" (if using the smartphone app) or don't enter the access code if using another method. 
2. Contact the Service Desk at servicedesk@ucsd.edu or 858-246-4357 immediately. 

It may be the case that your browser is blocking third-party cookies. The "remember me" option only works if an exception is made in the browser's security settings for third-party cookies coming from Duo Security. 

Duo's cookies are only used to remember a Remembered Device. The cookies and associated data are never used for advertising or marketing purposes.

To add an exception for Duo-served cookies, use the following format, depending on which browser you're using:
 

• Internet Explorer: *.duosecurity.com
• Firefox: https://duosecurity.com
• Chrome and Opera: [*.]duosecurity.com

Note that Safari does not allow setting exceptions for third-party cookies.

A lockout occurs after 10 consecutive failed login attempts. Common causes include:

• Not responding to the authentication attempts - for example, no authenticating via the push message or phone call
• Actively denying the login attempt 
• Entering incorrect passcodes

Your account will auto-unlock after 60 minutes. You can also contact the Service Desk for immediate resolution:

• Submit a ticket online at support.ucsd.edu
• Email servicedesk@ucsd.edu
• Call 858-246-4357 (7 a.m. - 7 p.m. Monday - Friday. For after hours service, choose option #3 on the phone greeting)
• Visit walk up desk at AP&M building, room 1313 (8 a.m. - 4:30 p.m. Monday - Friday) 

Using push notifications via the Duo app on a smartphone is the easiest way to complete the two-step login process. Other options include:

• Receiving a phone call on a cell phone or landline
• Receiving push notifications via a tablet
• Using a token (contact the Service Desk at servicedesk@ucsd.edu or 858-246-4357 to request one) 

First, simply trying re-typing the passcode, as you may have inadvertently entered it incorrectly.

If the passcode is still not accepted, it may be the case that your token has fallen out of sync with Duo. To re-sync:

1. Initiate a login attempt like normal and enter a passcode (which will fail).
2. Generate a new passcode. To do this, wait for the bars next to the passcode to run out and the token screen to shut off. You’ll then have to depress the gold power button/icon on the token to view a new passcode.
3. Enter the passcode and wait for it to fail.
4. Enter a passcode (and fail) three times. The fourth entry should be accepted.
5. If the token is still not working, contact the Service Desk.

Tokens sometimes become unsynced if too many passcodes are cycled through without being used. This could happen if the token is continually and inadvertently turned on and off while in your pocket, bag or elsewhere.

A token is a small device that displays a passcode that can be entered as the second step. A token is a good alternative for those not using phones for authentication or those who frequently access systems in locations without wifi or cell service. The token is small and many people affix to their keychain to ensure it's always close at hand. 

Check out the links below for help with Android or Apple, respectively, if push notifications aren't coming through when expected and/or you're having trouble authenticating. 

Android push notification troubleshooting

Apple iOS push notification troubleshooting

It's not about the phone, it's about the operating system you're on.

• For Apple devices, you'll need to be using iOS 12.0 or newer. 
• For Android devices, you'll need to be using Android 8.0 or newer.

Beginning February 1, 2021, devices running iOS 11 or Android 7 or older will no longer be able to install Duo Mobile from the Apple App Store or the Google Play Store. Users who have already downloaded the app on iOS 11 or Android 7 or older devices will continue to be able to authenticate using the app. 

If you don't want to, or can't, update your operating system, that's cool. There are other options, including requesting a token from the Service Desk at servicedesk@ucsd.edu or 858-246-4357.

The Duo app requires very little space:

• iOS, 10.6 MB
• Android, 30 MB

By all means! Learn more about how universal 2nd Factor (U2F) devices are compatible with Duo; learn more here

Note that the university doesn't provide U2F devices, but feel free to use your own.

Yes. When registering a landline or mobile phone, you'll see a dropdown menu with a comprehensive list of countries. Additionally, the country code prefix will automatically change. 

Note, however, that entering the auto-generated passcode within the smartphone app is a simpler and more reliable method of completing the two-step login process. 

Apple has a help center article that goes over how to sign up for an AppleID without setting up a payment method here: https://support.apple.com/en-us/HT204316.

Step 6 covers the step to skip adding in any payment information, including what to do if the “none” option does not appear for you.

UC San Diego Health personnel use a version of Duo and two-step login that applies to their systems and connections. For a variety of technical and compliance related reasons, they are not related. 

Therefore, Health personnel using campus VPN or single sign-on will have to register their devices through the steps described herein. You will not have to install the Duo app a second time. Both registrations will display side by side (see image below). Finally, when logging in, you won't have to decide which to choose - Duo will do that automatically. 

You have options!

1. Set your office landline as a backup authentication method. Note you'll need to set this option in advance of ever needing to use it.   
2. From the Duo app, you can generate 10 one-time use codes. Consider generating the codes, copying them  down and securing in a locked drawer for use if needed. 
3. If all else fails, contact the Service Desk at servicedesk@ucsd.edu or 858-246-4357 for a bypass code. 

For text message issues, read this information from T-Mobile.

For call issues, read this information from Duo.

Yes. An earlier issue with authentication calls to Chinese numbers (+86 country code) has been resolved. Read more on the Duo web site about phone calls to Chinese numbers.  

Our contractual agreements with vendors expressly ensure our data is protected. UC San Diego would never license this data for sale by a third party or for general use by a third party. The contract we have in place with Duo was negotiated by Internet2, a member-driven advanced technology community consisting of leading higher education institutions. Member institutions have the same privacy and security concerns as we do, and their expertise and input was contributed to the contract’s negotiation as well as product review.

As is necessary to detect and investigate compromised accounts, UC San Diego retains authentication logs. Access is highly restricted and governed by University of California policy – even during formal investigations. In fact, UC San Diego limits the collection and restricts the use of data far more aggressively than commercial providers.

Duo collects profile, device, connection and network information required for authentication and usability analytics (that can be disabled). The Duo app does not have access to personal information such as location, contacts, email, photos or other content on a device. Our agreement with Duo also includes safeguards to protect data use, sharing, confidentiality and privacy. Read the Duo privacy notice and the information Duo collects. 

The instructions for whitelisting Duo's cookies in Chrome explain how to protect privacy while browsing but also use the "Remember me for 7 days feature." 

You'll want to go to the section called "Change your cookie settings," then the section called "Allow or block cookies for a specific site." Follow the instructions; eventually, you'll want to "Allow" Duo. When prompted, type [*.]duosecurity.com