Risk-Based Authentication (RBA) Frequently Asked Questions
What is Risk-Based Authentication?
Risk-based authentication (RBA) is a method that assesses the risk of a login attempt and adjusts the security measures accordingly.
- Risk-Based Factor Selection: The system learns "normal user behavior" and spots patterns indicating an attack. If unusual activity is detected, you will be prompted to use a more secure method, like Verified Duo Push.
- Verified Duo Push: Requires you to enter a numeric code displayed on your computer into the Duo Mobile app, ensuring you are physically present at both devices.
- Risk-Based Remembered Devices: Checks for logins from unusual network locations. If a login is suspicious, it ends the "remembered device" session and requires a fresh login.
What are the benefits of Risk-Based Authentication?
RBA protects your account from "push harassment" and other credential-based threats by dynamically increasing security only when the threat level rises. This enhances security without adding friction to your daily routine in trusted locations.
What if I already have Duo Mobile on my smartphone?
If you are logging in from your regular devices and locations, there should be no change. However, you should familiarize yourself with the Verified Duo Push (KB0015659) screen, which appears in high-risk scenarios, such as:
- Accessing from a new device or IP address.
- Traveling to a new location.
- Unusual activity, such as multiple failed access attempts.
Why should I trust installing this on my personal phone?
Duo Privacy Commitment: Duo does not track your location, monitor your personal activity (what apps you use or browsing history), or collect personal data. It is designed to protect your account without invading your personal space.
- Duo only checks basic details to ensure the device is secure (e.g., OS type, security patches).
- Learn more from the vendor: Duo Mobile Privacy Information.
What information does Duo collect?
Duo collects two types of info: 1) Authentication logs (required for security and cannot be turned off) and 2) Analytical usage data. You can disable analytical data by going to Settings in the Duo app and turning off the "Send usage data" option.
What if I don't want the Duo App on my personal phone?
You have several approved alternatives to the smartphone app:
- Security Keys: You can request or purchase a physical security key (KB0012341).
- Digital Passkeys: Method such as LastPass, iCloud Keychain, or Google Password Manager are approved. These store your private key safely and can sync across your devices.
- Biometrics: Fingerprint readers on your computer are approved. Note: this limits you to that specific device; if you travel without your computer, you will need a backup method (like printed bypass codes).