Beginning February 8, 2021, York implemented its two-factor authentication (2FA) verification process through a third-party software called Duo. The decision to ramp-up on security follows a series of cyber attacks which intensified in the year 2020.
On May 1, 2020, York was hit by a cyberattack, which was quickly identified and shut down by the University Information Technology (UIT) staff. The attack caused many of York’s servers and work departments to be temporarily shut down, including Zoom, Moodle, on-campus student access to the internet, and Office 365, to name a few.
No sensitive information was compromised in this event, Chief Information Officer Donald Ipperciel clarified in a statement via Twitter.
While the systems were back up and running by May 5, students logging into Passport York were required to create a new password for safety measures.
This brings us to York’s up-to-date solution to cyberattacks: a 2FA process secured through the Duo Mobile app. To apply, you must first enter your mobile phone number and identify the device associated with it. To complete the process you are required to download the Duo Mobile app in order to scan a code, with a second option to verify using email instead.
The app will send push notifications to users trying to log in. The message will read “Login request: Passport York Login,” and will notify the user of the date, time, location, and name of the account that is attempting to be logged in. Two options are given: approve or deny.
While having to download a new app to your phone might seem inconvenient, it is proven that verification through an app is safer than SMS, which hackers can access more easily than an app.
The app was created by Dug Song, and Jon Oberheide, graduates of the University of Michigan. “The industry needs to change the way it looks at security. We need to make the process simpler, smarter, and more secure.” Oberheide expresses on the about section from their website. Customers of Duo Mobile include Toyota, Facebook, Etsy, and more.
The reaction of faculty, staff, and students at York towards the implementation of 2FA has been mixed, with some expressing their difficulties getting started.
Usman Arshad, fourth-year criminology student, and vice-president of Outreach for the Criminology Society at York, says that, “It gives us students a greater peace of mind knowing that our information is protected and secured.”
While 2FA has its benefits, such as protection, one-press login validation, and being an app that is free of charge for Android and iOS, it has its downsides as well.
“I found the entire process to be extremely difficult to figure out. I would consider myself a tech-savvy individual and even I had issues trying to set up the entire authentication,” continues Arshad.
This statement is one that other faculty, staff, and students find relatable.
For some, downloading the app is preferred over the alternative text message verification: “I downloaded the app and I think it would be more annoying if one had to use the text message verification format instead,” says Lora Zuech, administrative assistant for York’s School of the Arts, Media, Performance & Design.
For others, it is the timing that provides inconvenience. “The entire York community has had enough surprises over the last 12 months. Could this not have waited until May, when the community is smaller (on the student side) and perhaps slightly less fried in the faculty and staff quarters?” says Professor Kim Ian Michasiw, chair of the writing department.
Michasiw adds that people who don’t own phones, or don’t use them often, will be inconvenienced by the need to always have their phones on or near. “Those few of us who ever allow our phones to be further than arms-length away are being taught a lesson. The phone must always be with us and our location always known,” says Michasiw.
There have also been reports that the Duo Mobile app is not compatible with older models of phones.
York has been enrolling their faculty, staff, and students alphabetically, with the expectation that everyone will be fully enrolled by May of 2021.
