Duo 2FA - Revision history

Caleb: Fix grammar

2025-03-10T01:06:51Z

Fix grammar

imported>Bgregos: /* Issues */

2016-09-05T04:40:15Z

‎Issues

imported>Echarlie: /* Issues */

2016-04-18T23:20:24Z

‎Issues

imported>Echarlie: /* Device-Specific Information */

2016-04-18T23:18:49Z

‎Device-Specific Information

imported>Echarlie at 23:17, 18 April 2016

2016-04-18T23:17:37Z

imported>Echarlie: /* Privacy Policy */

2016-04-18T23:16:35Z

‎Privacy Policy

imported>Echarlie: /* Disclosure of PII */

2016-04-18T23:15:04Z

‎Disclosure of PII

imported>Echarlie: /* Privacy Policy */

2016-04-18T23:14:37Z

‎Privacy Policy

imported>Echarlie: Created page with "'''DUO Two-Factor Authentication''' is a proprietary service which provides 2FA through PAM modules and a web-browser login page. ''While VTLUUG concurs that 2FA is a good pra..."

2016-04-18T23:14:03Z

Created page with "'''DUO Two-Factor Authentication''' is a proprietary service which provides 2FA through PAM modules and a web-browser login page. ''While VTLUUG concurs that 2FA is a good pra..."

New page

'''DUO Two-Factor Authentication''' is a proprietary service which provides 2FA
through PAM modules and a web-browser login page. ''While VTLUUG concurs that 2FA
is a good practice, DUO is an ineffective, buggy, and anti-freedom solution''.

== Issues ==
DUO 2FA has a number of disadvantages and issues. To list a few:
* A cellphone, compatible tablet, or landline is '''mandatory''' to enrollment in 2FA
* U2F is exclusively supported in the Chrome and [[Chromium]] browsers, despite the presence of a [https://github.com/prefiks/u2f4moz functional plugin] which provides the feature in [[Firefox]]
** Duo login page is actually '''broken''' by use of this plugin
* [https://duo.com/legal/privacy Privacy policy] is a joke, and implies almost no level of customer or customer data protection

=== Privacy Policy ===
They collect PII. Among this is:

''''Device-Specific Information''': ''We also collect device-specific information (e.g. mobile and desktop) from you in order to provide the Services. Device-specific information includes:

* attributes (e.g. hardware model, operating system, web browser version, as well as unique device identifiers and characteristics (such as, whether your device is “jailbroken,” whether you have a screen lock in place and whether your device has full disk encryption enabled));
* connection information (e.g. name of your mobile operator or ISP, browser type, language and time zone, and mobile phone number); and
* device locations (e.g. internet protocol addresses and Wi-Fi).

We may need to associate your device-specific information with your Personal Information on a periodic basis in order to confirm you as a user and to check the security on your device.''

Other things they do:

* Collect data referencing users accessing services, ''the '''dates and times''' [they] are accessing the Services, from where [they] are accessing the Services (by internet protocol address) and device event information such as crashes, system activity, and hardware settings''

They also '''will''' disclose PII to governments, if requested:

* ''(i) if we are required to do so by law or legal process;''
* ''(ii) to respond to subpoenas, court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims;''
* ''(iii) as may be required for the purposes of national security;''
* ''(iv) when we believe disclosure is necessary and appropriate to prevent physical, mental, financial or other harm, injury or loss;''
* ''(v) in connection with an investigation of suspect or actual illegal or inappropriate activity or exposure to liability''

[[category:Campus Computing Resources]]

← Older revision		Revision as of 23:15, 18 April 2016
Line 35:		Line 35:


−	[[category:Campus ~~Computing Resources~~]]	+	[[category:Campus computing resources]]

← Older revision		Revision as of 23:14, 18 April 2016
Line 25:		Line 25:
	* Collect data referencing users accessing services, ''the '''dates and times''' [they] are accessing the Services, from where [they] are accessing the Services (by internet protocol address) and device event information such as crashes, system activity, and hardware settings''		* Collect data referencing users accessing services, ''the '''dates and times''' [they] are accessing the Services, from where [they] are accessing the Services (by internet protocol address) and device event information such as crashes, system activity, and hardware settings''

		+	==== Disclosure of PII ====
	They also '''will''' disclose PII to governments, if requested:		They also '''will''' disclose PII to governments, if requested:

@@ Line 6: / Line 6: @@
 == Issues ==
 DUO 2FA has a number of disadvantages and issues. To list a few:
-* A cellphone, compatible tablet, or landline is '''mandatory''' to enrollment in 2FA
+* A cellphone, compatible tablet, or landline is '''mandatory''' for enrollment in 2FA
 * U2F is exclusively supported in the Chrome and [[Chromium]] browsers, despite the presence of a [https://github.com/prefiks/u2f4moz functional plugin] which provides the feature in [[Firefox]]
 ** A workaround for Firefox has been posted [[Yubikey#Using_with_Virginia_Tech_2-Factor_(Duo)|here]].

@@ Line 8: / Line 8: @@
 * A cellphone, compatible tablet, or landline is '''mandatory''' to enrollment in 2FA
 * U2F is exclusively supported in the Chrome and [[Chromium]] browsers, despite the presence of a [https://github.com/prefiks/u2f4moz functional plugin] which provides the feature in [[Firefox]]
-** Duo login page is actually '''broken''' by use of this plugin
+** A workaround for Firefox has been posted [[Yubikey#Using_with_Virginia_Tech_2-Factor_(Duo)|here]].
 * [https://duo.com/legal/privacy Privacy policy] is a joke, and implies almost no level of customer or customer data protection
 * Use of app isn't ''real'' 2 factor authentication, as it doesn't require the person initiating login to posses device

@@ Line 17: / Line 17: @@
 ''We also collect device-specific information (e.g. mobile and desktop) from you in order to provide the Services. Device-specific information includes:
-* attributes (e.g. hardware model, operating system, web browser version, as well as unique device identifiers and characteristics (such as, whether your device is “jailbroken,” whether you have a screen lock in place and whether your device has full disk encryption enabled));
+* ''attributes (e.g. hardware model, operating system, web browser version, as well as unique device identifiers and characteristics (such as, whether your device is “jailbroken,” whether you have a screen lock in place and whether your device has full disk encryption enabled));''
-* connection information (e.g. name of your mobile operator or ISP, browser type, language and time zone, and mobile phone number); and
+* ''connection information (e.g. name of your mobile operator or ISP, browser type, language and time zone, and mobile phone number);''
-* device locations (e.g. internet protocol addresses and Wi-Fi).
+* ''device locations (e.g. internet protocol addresses and Wi-Fi).''
-We may need to associate your device-specific information with your Personal Information on a periodic basis in order to confirm you as a user and to check the security on your device.''
+''We may need to associate your device-specific information with your Personal Information on a periodic basis in order to confirm you as a user and to check the security on your device.''
 Other things they do:

@@ Line 1: / Line 1: @@
 '''DUO Two-Factor Authentication''' is a proprietary service which provides 2FA
-through PAM modules and a web-browser login page. ''While VTLUUG concurs that 2FA
+through PAM modules and a web-browser login page. ''While VTLUUG concurs that 2FA''
-is a good practice, DUO is an ineffective, buggy, and anti-freedom solution''.
+''is a good practice, DUO is an ineffective, buggy, and anti-freedom solution''.
 == Issues ==

@@ Line 13: / Line 13: @@
 They collect PII. Among this is:
-''''Device-Specific Information''': ''We also collect device-specific information (e.g. mobile and desktop) from you in order to provide the Services. Device-specific information includes:
+==== Device-Specific Information ====
 * attributes (e.g. hardware model, operating system, web browser version, as well as unique device identifiers and characteristics (such as, whether your device is “jailbroken,” whether you have a screen lock in place and whether your device has full disk encryption enabled));