Case Study: What It Is Like to Use Two-Factor for Weblogin

Wondering what it might be like if you turn on two-factor for Weblogin? My name is Janet, and I work for ITS. This is what it's like for me. Your experience may be different, depending on the devices you use and the things you log in to.

Contents

The Devices I Use

I have a personal iPhone, iPad, and MacBook Air. My U-M work computer is a MacBook Pro.

The Things I Log In To Via Weblogin

  • U-M Google for Mail, Calendar, and Drive
  • Employee Self Service on Wolverine Access
  • Time Approval on Wolverine Access
  • Drupal content management system (for updating web pages)
  • MCommunity Directory
  • ITS intranet Planview (ITS time tracking system)
  • Qualtrics

My Duo Enrollment Options

  • App on my iPhone. I installed the Duo Mobile app on my iPhone and enrolled that in Duo two-factor.
  • Office landline phone. I also enrolled my office desk phone as a backup option in case I forget to take my phone to work someday.

What Happens When I Use My Phone or iPad

  • Using apps—two-factor not needed. When I log into my U-M Google Mail from my iPhone or iPad, I don't see two-factor at all. I tap the Gmail app icon and get directly into my mail without logging in. The same thing happens when I use U-M Google Drive or other apps, such as iCalendar, that I have connected to my U-M Google account.
  • Using a web browser—must approve the login. When I open Chrome to get to the MCommunity Directory to set my Away Message, I am prompted to log in via Weblogin. I enter my uniqname and UMICH (Level-1) password and click Login as usual. Then the two-factor screen appears as a second login step. I have not set Duo up to do anything automatically because I like to be able to choose the option I will use when I log in. Here is what I see:
  • What happens when I log in via Weblogin

    I usually click the Send Me a Push button, because that is the quickest option. When I do that, my iPhone lets me know I have a login request. I swipe the request notification to the left to open it, and then tap Approve. Because I have a passcode set for my phone, I must enter my phone passcode. Then I am logged in.

What Happens When I Use My Computer

When I log into my U-M Google Mail from either my home or work computer, I open the Chrome web browser and go to mail.google.com/a/umich.edu.

On the Weblogin screen, I type my uniqname and UMICH (Level-1) password, and click Login. Then the two-factor screen appears as a second login step (see screen shot above). I click Send Me a Push, then my iPhone notifies me that I have a login request. I swipe the request notification to the left to open it, and then tap Approve. Because I have a passcode set for my phone, I must enter my phone passcode. Then I am logged in.

I can use many other web sites and applications that require Weblogin without needing to log in again. If it has been awhile since I last logged in or I go to a site that requires login every time, I may be prompted to log in and approve the login again. See Reauthentication and Time-Out Periods.

Using My Backup Options

  • Using a phone call. If I get a new phone and don't have the Duo Mobile app set up on it, I can approve my login via a phone call. I choose Call Me and then get a phone call on my iPhone. I answer and am prompted to press 1 to approve the login.

    Using a phone call

  • Using a passcode. If I don't have cellular or internet connectivity, I can use the Duo Mobile app to generate a passcode. I choose Enter a Passcode. Then I open the Google Mobile app on my phone and tap the Key icon to get a passcode to enter to login.

    Using a passcode

  • Using a different phone number or device. From the Device menu at the top, I can choose my office landline.

    Using a different phone number or device

    Next, I click Call Me. My office phone rings. I answer and am prompted to press 1 to approve the login.

What a Typical Day Is Like

I am prompted to use two-factor from two to five times a day. Some examples:

December 16
Checked email throughout the day from my phone and iPad. Used multiple sites that use Weblogin. Was prompted for two-factor twice.

  • 8:10 a.m. Used two-factor when logging in to Google U-M Mail in Chrome from my work computer after I ran Software Update and had to restart the computer.
  • 2:10 p.m. Went to the ITS intranet and was prompted to log in and use two-factor.
  • Note: Was prompted to re-authenticate at 10:00 a.m. when I logged into the MCommunity Directory, but was not prompted for two-factor.

December 19
Checked email throughout the day from my phone and iPad. Used multiple sites that use Weblogin. Was prompted for two-factor five times.

  • 8:45 a.m. Logged in to Drupal from Chrome to edit a website. Prompted to use two-factor.
  • Noon. Logged in to Wolverine Access from Firefox and was prompted for two-factor.
  • 1:30 p.m. Logged in to Drupal from Chrome to edit a different website and was prompted for two-factor.
  • 2:30 p.m. My work computer froze and I had to restart it. Prompted for two-factor when logging in to Google U-M Mail from Chrome.
  • 4:30 p.m. Logged in to Manager Desktop in Wolverine Access from Firefox and was prompted for two-factor.

January 4
Checked email throughout the day from my phone and iPad. Used multiple sites that use Weblogin. Was prompted for two-factor twice.

  • 8:15 a.m. Logged out of my work computer for a software update. Logged in to Google U-M Mail from Chrome and was prompted for two-factor.
  • 4:20 p.m. Logged in to Qualtrics from Chrome and was prompted for two-factor.
Last Updated: 
Tuesday, January 24, 2017