Thursday, July 18, 2024

To help combat significant increases in payroll fraud and other scams, EITS is changing the process for generating passcodes in Duo, the application behind ArchPass, UGA’s two-step login solution.

Passcodes are one method, along with push notifications and a phone call, you can use to verify your identity when you log in to a UGA application protected by ArchPass.

• Moving forward, passcodes generated in the Duo Mobile App will expire 30 seconds after generation, rather than after they are used to log in. This change helps ensure passcodes are not used by threat actors, who may gain access to a user’s credentials through a phishing attempt.
• Effective August 2, passcodes sent through SMS texting will expire after five minutes, rather than after being used to log in. One passcode will be sent via SMS at a time, regardless of the Duo-protected application you are trying to access.
• Effective August 2, when a user enrolls or removes a device from their Duo account, they will receive an email notification to their UGAMail address. This will help ensure scammers can’t add devices and use them to access your information or UGA systems.

An example of the email Duo sends when you add a device.

An example of the email Duo sends when you remove a device. 

Changes to Duo Self-Service Portal

Additionally, the look and feel of the Duo Self-Service Portal will change on August 2. The portal, available at archpass.uga.edu, is used to enroll and remove devices used to verify your credentials.

Effective August 2, the portal will use Duo’s new universal authentication prompt. When a user logs into the Duo Self-Service portal, a new screen will ask them to verify their identity using one of the Duo authentication methods before managing their devices. Once they verify their identity, they will be able to add and remove devices.

Users with no devices set up in Duo will be prompted to enroll the first time they log in.

The new device management screen in the Duo Self-Service Portal. 

For more information on any of these changes, please contact Ben Myers at bmyers@uga.edu.