2-factor authentication (2FA)

Logging on to sensitive systems/services with a password alone is no longer sufficient given the current state of technology. Passwords can be picked up quickly and easily by well-crafted phishing mails. Often, for the sake of simplicity, passwords are also so poorly chosen that they can be easily guessed by attackers. Despite constant efforts to sensitize all university members to the use of secure passwords and the recognition of phishing attempts, the number of hijacked university IDs is high. Even one captured password is enough to cause significant damage, for example, through data tapping or ransomware.

To counter this problem, there is the principle of 2-factor authentication (abbreviation: 2FA). In addition to the password as the "first factor", a "second factor", a so-called token, is also required for logging in. This can be, for example, a hardware (access from a certain device, USB stick,...) or also a PIN (created by a generator or similar). When logging in, the token is requested in addition to the password. Numerous large providers and banks already use this effective procedure, because it makes it extremely difficult for attackers to access sensitive systems/services, since the captured password alone is no longer sufficient.

The goal is for 2FA to become commonplace at the university. Just as it already is in other places in everyday life (example PIN in online banking, email token or SMS token on social media platforms,...). On the following pages, you will find all the information you need to activate 2FA on your own and select suitable tokens. In addition, under the heading Services/Platforms, you will find an overview of where 2FA is already supported during login, or is even mandatory. This list, as well as the general information about 2FA, will be updated continuously. If you would like to be informed by mail about all new developments concerning 2FA, you can subscribe to our 2FA newsletter here: www.listserv.dfn.de/sympa/subscribe/2fahstr. If you have any problems with registration or login, please contact our IT helpdesk.

For more information on the topic, see the video embedded below (which provides a good initial overview) and the following websites:

• BSI info page on the topic of "2-factor authentication"
• Wikipedia article "Multi-factor authentication"