As of Feb. 2 IU requires all employees and alsso retirees to use Duo two-step login. Other IU students can opt into the program, but it is only required for those working for or who have worked for the University, Devin Bontreger, a University Information Technology Services hourly consultant, said.
“Other than that they don’t need it,” Bontreger said.
Bontreger said UITS has received more calls about the login system, but most of those additional calls and walk-ins have been from staff or faculty. Some staff have come in and thought the new system meant they would register one laptop or device and only be able to access the system from there. Overall, Bontreger said the change has been a simple one, even with the additonal calls.
“It’s been better than we could’ve expected,” Bontreger said.
Brenan Wynn, a senior studying psychology and neuroscience at IU who is also a floor manager in Ashton Center, said while he thinks Duo is a good system with one of the quickest push notification systems, he thinks it is “overcompensating.” He said it should not be necessary on certain websites, like Canvas, where all anyone could hack would be his online quizzes.
“I just feel the Duo system is a bit of a hassle,” Wrynn said. “I don’t think it’s necessary to need the protection on Canvas.”
Wrynn also said he worried about those without smartphones and questioned what they were to do, but Bontreger said not to worry too much because UITS is providing a Duo token, which can provide the code someone needs to login.
“The tokens are free, they work anywhere, and it’s free to get,” Bontreger said.
Each token provides a one-time code with the push of the button. Jorge Campana Paez, an IU junior studying human biology and environmental sustainability who has one of these tokens on his key ring, said it’s easier for him to keep one of those than to have Duo on his phone.
“My phone would just constantly die,” Paez said. “The token is just another key — this one for the web.”
Paez said he switched over at the start of the semester. For him Duo is just something he has to do, but it does not bother him.
“It’s just another thing,” Paez said.
Bonteger said he believed the system to be much more secure than previously. He said someone would now require a username, passphrase and the Duo device to hack someone’s account.
However, if someone loses their device they would need to either walk-in with photo ID or call and provide authentication for a supervisor to check in order to login with Duo. Bonteger said their response time is generally within an hour, but it’s a good idea to have at least two devices registered.
“We can generate a temporary bypass code, but make sure you have more than one device on there,” Bonteger said.
