Duo 2FA

DUO Two-Factor Authentication is a proprietary service which provides 2FA through PAM modules and a web-browser login page. While VTLUUG concurs that 2FA is a good practice, DUO is an ineffective, buggy, and anti-freedom solution.

Issues

DUO 2FA has a number of disadvantages and issues. To list a few:

• A cellphone, compatible tablet, or landline is mandatory to enrollment in 2FA
• U2F is exclusively supported in the Chrome and Chromium browsers, despite the presence of a functional plugin which provides the feature in Firefox
  • Duo login page is actually broken by use of this plugin
• Privacy policy is a joke, and implies almost no level of customer or customer data protection

Privacy Policy

They collect PII. Among this is:

'Device-Specific Information: We also collect device-specific information (e.g. mobile and desktop) from you in order to provide the Services. Device-specific information includes:

• attributes (e.g. hardware model, operating system, web browser version, as well as unique device identifiers and characteristics (such as, whether your device is “jailbroken,” whether you have a screen lock in place and whether your device has full disk encryption enabled));
• connection information (e.g. name of your mobile operator or ISP, browser type, language and time zone, and mobile phone number); and
• device locations (e.g. internet protocol addresses and Wi-Fi).

We may need to associate your device-specific information with your Personal Information on a periodic basis in order to confirm you as a user and to check the security on your device.

Other things they do:

• Collect data referencing users accessing services, the dates and times [they] are accessing the Services, from where [they] are accessing the Services (by internet protocol address) and device event information such as crashes, system activity, and hardware settings

They also will disclose PII to governments, if requested:

• (i) if we are required to do so by law or legal process;
• (ii) to respond to subpoenas, court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims;
• (iii) as may be required for the purposes of national security;
• (iv) when we believe disclosure is necessary and appropriate to prevent physical, mental, financial or other harm, injury or loss;
• (v) in connection with an investigation of suspect or actual illegal or inappropriate activity or exposure to liability