MFA is a form of security that protects an account with two layers of authentication. The first layer is a PIN number or password, something that you know. The second factor is something that you physically have, such as a device. For example, a bank account uses MFA for security by requiring both a PIN and a debit card. The university’s MFA provider is a company named Duo Security (Duo for short).

After you enroll in MFA, when you log in to any MFA-protected website or service, you will enter your username and password (something you know) as you do today, and then use your smartphone or another device (something you have) to verify your identity.

All employees and UA students using any university SSO service are required to use MFA.

MFA prevents others from signing in as you, even if they know your password. It protects you and the University of Alaska from the risks of phishing scams and other forms of passwords theft. 

Users’ passwords have been compromised by many different methods: guessing, hacking, watching you type the password, capturing the password on a computer with malware installed that records keystrokes, capturing passwords sent over a compromised network connection, capturing cached passwords on servers receiving passwords. Even the most careful user cannot be certain their password is never compromised by one or more of these attacks.

After you enroll in MFA, when you log in to any MFA-protected website or service, you will enter your UA Username and password  as you do already, and then use your smartphone or another device to verify your identity. 

The additional verification is not a second password, but a verification that depends on something else, such as demonstrating possession of your unlocked smartphone, or a security key, or a “biometric” such as a fingerprint, none of which would be compromised by even a successful attack on your password.

The University's MFA provider is a company named Duo Security (Duo for short).