Risk Based Authentication - FAQs

Risk-based authentication (RBA) is a method that assesses the risk of a login attempt and adjusts the security measures accordingly.

Risk-Based Factor Selection: Looks at authentication requests and adjusts security measures based on risk. It learns what “normal user behavior” is and spots patterns that may indicate an attack. If it detects a known attack pattern or unusual activity, the person will be prompted to use the most secure method, like Verified Duo Push.

Verified Duo Push Selection Methods: Requires users to enter a numeric code from their mobile device authentication prompt, adding an extra layer of security by requiring interaction with both the access and the authentication devices (e.g., phone and computer, tablet and computer).

Risk-Based Remembered Devices: Checks for logins from unusual network locations. If it finds a suspicious login, it ends the remembered device session, and users must log in again. It looks at the last 30 days of successful authentications to determine activity.

Risk-based authentication (RBA) checks your login attempts for signs of push harassment and other threats. It may automatically increase your security methods depending on the potential threat level at the time of login. Verified Duo Push is one of these methods. It requires you to enter a unique code displayed on your computer or device into the Duo Mobile app.

RBA enhances security by:

• Preventing accidental approvals and blocking unauthorized access.
• Dynamically adjusting authentication requirements based on observed risk factors.
• Improving the user experience by only asking for additional verification when necessary.

We encourage you to learn about the Verified Duo Push screen. When risk-based authentication is turned on, Duo may show you a "Verified Duo Push" instead of the usual push notification. This is known as step-up authentication, which happens based on the situation. If you are logging in from your regular devices and locations, there should be no changes. The new screen, called Verified Duo Push, appears when Duo thinks your access request is high risk.

• Accessing from a new device or IP address
• Traveling to a new location
• Unusual activity, such as multiple failed access attempts

We do! Share our flyers for moving onto the Duo Mobile App - available in English | Spanish | Simple Chinese

We understand that you may be hesitant to install Duo on your personal phone, but rest assured, Duo does not track your location, monitor your activity, or collect personal data. It simply adds an extra layer of security to protect your accounts, ensuring only you can access them.

• Duo does NOT track your personal activity. It only checks basic details like the type of device you're using (e.g., iPhone, Windows PC) and whether it’s secure.
• Duo does NOT collect your personal data. It does not track your location, what apps you use, or your browsing history.
• Duo’s data collection is minimal and for security purposes only. It helps IT teams ensure devices are safe from cyber threats and does not spy on you.

If you’re concerned about privacy, rest assured that Duo is designed to protect your account without invading your personal space. Learn even more Duo Mobile Privacy Information(link is external) 

You can request a security key–or buy your own. We recommend several options on the security key page. Just keep in mind that you will only be able to authenticate using those physical keys. So, if you lose the key, you'll need another method in place.

You cannot sign into campus systems using SMS text messages or simple hardware tokens. When you try logging into CalNet, you will be asked to select "manage devices" to add another method in the mycalnet.berkeley.edu portal - to Duo Mobile App, Security Key, or Bypass codes.

This method is approved under the new enhancements. It works by storing your private key safely on your device and allows you to sync your passkeys across different devices within a platform's ecosystem, such as LastPass, iCloud Keychain, or Google Password Manager.

This method is approved under the new enhancements. However, you will only be able to authenticate using that physical device. So, if you plan on traveling and not taking your computer, it's best to use Duo Mobile or to print bypass codes.

Duo collects two types of information from you. The first type pertains to your authentication attempts; this information is always sent and cannot be turned off. The second type is analytical data, which you can choose to disable. To stop sending your analytical data to Duo, open the app, go to Settings, and turn off the option for sending usage data. Learn more about data privacy with Duo Push.