Google 2-Step Verification, Wake Forest University's enterprise 2FA solution

Google 2-Step Verification is the official Wake Forest University multi-factor authentication service. Newcomers to Wake Forest must set up Google 2-Step Verification within 30 days of account activation, after such time the account will be locked. 

Multi-factor authentication helps your important accounts know it is you logging in. "Multi-factor" refers to some different approaches to validating a login's authenticity:

1. A password: in other words, something you know.
2. A mobile device, phone, or file with your unique backup codes: something you have.
3. biometric methods, such as your fingerprint/TouchID or "FaceID" from your own laptop or mobile device: something you are.

Hackers, phishers and other bad actors have many tactics to attempt to get the information you know, but it's far more challenging to get around the other two.

How Do I Enable 2-Step Verification?

• Have your primary phone nearby (usually, your mobile).
• Go to the 2-Step Verification page. You will be prompted to sign in to your WFU Google Account.
• Select Get Started and follow the quick step-by-step setup process.

Once you're finished, you'll be taken to the 2-Step Verification settings page. You must set up one 2-step method, and we recommend you set up a few other methods in case your primary is lost, stolen or malfunctioning. When 2FA is required, you'll be able to use any one of these methods.

2-Step Verification Methods

Note: Methods with an * are recommended for those who are going abroad.

Google Prompt*

Tap in an app to confirm it is you.

Set up Google Prompt

Pros: Fast and easy. Is automatically set as the default method of authentication when enabled.

Cons: Requires connection to data (cell or Wi-Fi).  

Passkeys

Passkeys use your faceID, TouchID, or Fingerprint authentication on your trusted mobile and laptop devices. Passkeys provide the strongest protection against threats like phishing. Once you create a passkey, you can use it to easily sign in to your Google Account, as well as some third-party apps or services, and to verify it's you when you make sensitive changes

Set up passkeys. Note: Keep going if you see an error like the one below, when you try to set up a passkey. Select create a passkey. You'll still be able to use it in partnership with your password (i.e. as your 2FA). The error indicates that this is not available as a sole means of logging in ("password-less").

Pros: As secure as a security key, but more convenient. We recommend setting up as many passkeys as you can. For instance, use your faceID on your mobile and your fingerprint from your laptop as two additional 2-step options.

Cons: faceID and touchID sometimes don't work in certain environments (for instance, in the dark). It's important to have a backup method.

Google Authenticator Authenticator App*

A mobile app generates codes unique to you which you then type into a field on login.

Install Google Authenticator for iOS and Android.

Pros: Does not require an internet connection.  Is automatically set as the default method of authentication when enabled. Can be used for other accounts as well. Authenticator is synchronized to your account (in the event you get a new device).

Cons: it can be a bit less convenient to type codes into a field.

Backup Codes*

Emphasis is on the word backup. These are handy if you plan to travel, just in case.

You can create up to 10 2FA backup codes at a time, and save them (print or digital) in a secure location.  Each code can only be used once.  If you run low, you can generate more.

Generate backup codes.

Pros: Does not require internet connection or a physical device.  They do not expire.

Cons: Less convenient. Once you run out, you would need to generate more.

Security Key

A security key is a small device you can carry on your keychain, which is unique to you and acts like a physical key to your account. When prompted, you can insert in your laptop or phone's usb port and tap or click its small button.

Get and configure a security key.

Pros: Does not require connection to internet.

Cons: Some models do not work with mobile phones. Is also incompatible with less common browsers or operating systems (like those found on TVs).

Two-step verification phones

Google can send you a call or SMS text through your verified phone numbers. Configure a primary and a backup.

Set up phones.

Pros: If you lose or misplace your primary phone, a backup phone allows you to regain access to your account through a call or SMS text. 

Cons: a phone call or SMS relies on service coverage. The phone call method typically introduces delays or retries, and can be more time-consuming.

When Will I Be Prompted For 2-Step Verification?

• New sign-in from a new device
• New sign-in from a new browser or application
• Occasionally if signing in from a new location
• After a password change

More on 2-step

Google Support Article: Fix common issues with 2step verification. This covers common challenges such as a new or lost phone.

Avoid delays down the road with the customized "Your Google Account Checklist" for your @WFU.edu Google Workspace account.

If your phone was lost or stolen, change your WFU Google Account password immediately. Doing so will log you out of active sessions and protect your data. You may also contact the Information Systems Service Desk for assistance.

If you are affiliated with Wake Forest University and none of your 2-Step options are working, you can call the Information Systems Service Desk or visit us at The Bridge located on the main floor of the Z. Smith Reynolds Library. For your account security, we'll go through a process to verify your identity to ensure only you are given access to your WFU account. This is most easily accomplished in person, but IS has ways to confirm your identity remotely as well.