Overview
Two-step authentication uses two forms of authentication to verify your identity. First, you enter your SUNet ID and password. Then you need a physical device such as your mobile phone, tablet, or landline phone to complete the login. This approach protects your Stanford account from fraudulent access.
There are five physical devices that you can use to provide the second factor of two-step authentication. Each device has one or more authentication methods available.
| Device Type | Authentication Options | Supported Platforms |
|---|---|---|
| Smartphone |
|
|
| Tablet |
|
|
| Mobile Phone |
|
|
| Landline |
|
|
| Hardware Token |
|
|
| YubiKey |
|
|
Note: If you currently use Google Authenticator for your second factor you can continue to do so. However, you are no longer able to set up Google Authenticator on your smartphone or tablet. The Duo Mobile app is the preferred replacement.
Getting started
To get started, select the device you want to set up:
One device must be designated as your default device, and your default device must have a preferred way to authenticate. Stanford Login prompts you to authenticate using your default device and preferred method but you have the option of authenticating using a different device (if you have other devices set up) or method.
You are strongly encouraged to set up a backup device in case your primary device is lost or unavailable.
What to expect with two-step authentication
Once you enable two-step authentication, you may see an extra page after you sign into a Stanford resource via Login. This page prompts you to authenticate on your default device using the default method you set up. You also have the option to authenticate using another method on your device or using another device that you have previously set up. How frequently you are asked to authenticate on your default device varies, depending upon:
- the website you're accessing (for added security, some sites always require a two-step authentication)
- your individual browser settings (whether or not you clear cookies)
- whether or not you use more than one computer and web browser (two-step authentication is requested at least every 90 days for each computer and each browser you use to access protected websites)
- whether you check the Remember me for 90 days box during the login process
How you authenticate depends upon the device and method you chose for two-step authentication:
- If you chose Duo Mobile push notifications: a push notification is sent to the device, and you can review the request and tap Approve to authenticate. Internet or cellular access is required.
- If you chose a Duo Mobile passcode: launch the Duo app on your mobile device and click the key icon to see your current six-digit passcode. Enter the passcode on the two-step authentication screen to authenticate. Because this method is time-based, you don't need cellular service or internet access.
- If you chose SMS text message: you receive a text message on your device containing a passcode. Enter the passcode on the two-step authentication screen to authenticate.
- If you chose Phone Call: you receive an automated phone call that requires you to press or tap any key on your phone to authenticate.
- If you chose Hardware Token: press a button on the token to obtain a passcode, then enter the passcode on the two-step authentication screen to authenticate.
Information for international travelers
We recommend that anyone who travels internationally and needs to log in to Stanford websites use the Duo Mobile Passcode option or a hardware token. You can use Duo Mobile Passcode to generate your authentication code without an Internet or cellular connection. If you don't have a smartphone or tablet, hardware tokens that generate codes are available.
