Understanding Duo Authentication Device Options

Summary

Explore the methods to the authenticate via Duo

Body

Overview

Multifactor authentication, provided by Duo Security, adds another layer of security to your online accounts when using Pitt Passport by requiring multiple “factors” to verify your identity when you log in to a service. Duo outlines three main types of authentication:

Something you know: This knowledge-based method relies on something the user knows, such as a password, PIN, or personal security questions.
Something you have: This method verifies user identity through a physical item the user possesses, such as a mobile phone, a security token, or a smart card. The item either generates or receives an OTP or serves as a physical key.
Something you are: Biometric authentication types, such as fingerprints and facial recognition.

When possible, we encourage you to use a platform authenticator, roaming authenticator, or Duo Push on your compatible smartphone, tablet, or Apple Watch because it is the fastest, most efficient, and most secure authentication method.

Tip: You can also generate a passcode at any time from within the Duo Mobile app, even without a WiFi or cellular data connection. Just click on the University of Pittsburgh account drop-down menu and a code will be generated for you.

If the Duo Mobile application is not a practical authentication option for your situation, or if you are looking to register an additional authentication device, consider the following alternatives:

Authentication Options

Smart Cell Phone (Duo Push)

Once you download the Duo app and enroll your smart phone, using the Push notification option is the recommended choice.

Non-Smart Cell Phone or Landline

Our instance of Duo currently works with all cell phones and landlines by supporting authentication via phone call and SMS passcodes. However, these methods will be phased out for more secure methods.

Security Key

Duo supports security keys, offering secure login approvals resistant to phishing attacks combined with the one-tap convenience you're already used to with Duo Push.

What are Security Keys?

A security key plugs into your USB port and when tapped or when the button is pressed it sends a signed response back to Duo to validate your login. Duo uses the WebAuthn authentication standards to interact with your security keys. You may also see WebAuthn referred to as "FIDO2".

Security Key Requirements

To use a security key with Duo, make sure you have the following:

A supported browser: Chrome, Safari, Firefox, or Edge. Refer to the Universal Prompt browser support table for minimum browser versions with security key support in Duo.
A supported security key. WebAuthn/FIDO2 security keys from Yubico or Feitian are good options. U2F-only security keys (like the Yubikey NEO-n) can't be used with the Universal Prompt. itt does not provide security keys to users.

In order to use a security key with Duo, make sure you have the following:

A supported browser (Chrome 70, Firefox 60, Safari 13 or later), or Microsoft Edge 79 or later. Support for authentication is limited to web applications that show Duo's inline browser prompt.
An available USB port.
A supported USB security key. WebAuthn/FIDO2 security keys from Yubico or Feitian are good options. Duo does not support U2F-only security keys (like the Yubikey NEO-n). Pitt does not provide security keys to users.

Platform Authenticators

To request Platform Authentication to be enabled as an option, submit a ticket to our Security team to have it authorized on your account by clicking this link: Duo Multifactor Authentication Ticket.

Platform authenticators are authentication methods built into the device you use to access services and applications protected by Duo. Examples of platform devices would be Touch ID on Mac, Face ID on an iPhone, Windows Hello, and Android biometrics.

Touch ID on Mac

In order to use Touch ID with Duo, make sure you have the following:

A MacBook Pro, MacBook Air, or Magic Keyboard with a Touch ID button.
A fingerprint enrolled in Touch ID (see how to do this at the Apple Support site).
A supported browser: Safari or Chrome. Refer to the Duo browser support table.
iCloud Keychain sync enabled on all the Apple devices you will use with Duo and the passkey you will create during setup.

Touch your Mac's Touch ID sensor when prompted to log in to the application. If you aren't able to access the Touch ID sensor (such as when you close and dock your laptop), then you can choose to type in your Mac login password instead to verify. If you need to cancel a Touch ID authentication in progress, click or tap the cancel option shown by your browser, outside of the Duo Universal Prompt.

Face ID or Touch ID on an iPhone or iPad

In order to use Face ID or Touch ID on an iPhone or iPad with Duo, make sure you have the following:

An iPhone or iPad that supports Face ID or Touch ID.
Face ID or Touch ID already set up on the iPhone or iPad. Learn how to set up Face ID or set up Touch ID at the Apple Support site.
iCloud Keychain sync enabled on all the Apple devices you will use with Duo and the passkey you will create during setup.

Depending on the option your device supports, you'll either scan your face to use Face ID while logging in, or you'll scan your fingerprint instead to use Touch ID.

Windows Hello

In order to use Windows Hello with Duo, make sure you have the following:

A device running Windows 10 or later.
Windows Hello set up on the device for signing in with a PIN, fingerprint, or facial recognition. Learn how to set up Windows Hello at the Microsoft support site.
A supported browser: Chrome, Edge, or Firefox. Refer to the Duo browser support table. Note that Chrome Incognito and Edge InPrivate browsing won't work with Windows Hello, but will work with Security Keys.

Follow your device's prompt to enter your Windows Hello PIN, scan your fingerprint, or use facial recognition to log into Duo.

Android Biometrics

In order to use Android Biometrics with Duo, make sure you have the following:

An Android device that supports biometrics, like fingerprint or face unlock.
Facial or fingerprint unlock set up on that device. Go to Settings → Security to change your unlock settings. Refer to the Google support articles Unlock your Pixel phone with your fingerprint and Unlock your Pixel phone with your face, the Samsung articles Set up and use the fingerprint sensor on your Galaxy phone and Use Facial recognition security on your Galaxy phone, or your device manufacturer's support site for examples of how to do this.

Follow your device's prompt to scan your fingerprint or use facial recognition to log into Duo.

Details

Article ID: 600

Created

Wed 12/20/23 3:37 PM

Modified

Wed 4/22/26 11:31 AM

Related Services / Offerings

Related Services / Offerings (2)

Drop-In Support

IT SERVICE DELIVERY AND SUPPORT Pitt Digital provides Drop-In Support to provide hands-on help for the personal devices of students, faculty, and staff.

Duo Multifactor Authentication

IDENTITY AND ACCESS MANAGEMENT Duo provides multifactor authentication to add another layer of security to your online accounts.

Understanding Duo Authentication Device Options

Summary

Body

Overview

Authentication Options

What are Security Keys?

Security Key Requirements

Touch ID on Mac

Face ID or Touch ID on an iPhone or iPad

Windows Hello

Android Biometrics

Details

Details

Related Articles

Related Articles (6)

Related Services / Offerings

Related Services / Offerings (2)

Attachments

Attachments (1)

Promoting_Push_Guide.pdf · 79 KB Computer