Article Intended For
Penn State University employees, students, and other affiliates who want to learn about phishing-resistant multifactor authentication (MFA) and how it protects their Penn State Account.
Introduction
This article provides information regarding phishing-resistant MFA, passkeys, and provides links for how to enroll and use it.
Article Body
What is Phishing-Resistant Multifactor Authentication (MFA)?
Phishing-resistant MFA provides additional protection for your Penn State Account by using sign-in methods that are designed to prevent phishing attacks. While traditional MFA methods, such as Microsoft Authenticator push notifications and number matching provide strong account security, they still rely on a password and are not considered phishing-resistant.
What are Passkeys?
Passkeys are a phishing-resistant technology that replace your password. They cannot be easily stolen or entered into a fraudulent website like a password can. Passkeys can be stored in several ways, including on your smartphone, computer, password manager, or a physical FIDO2 security key.
Once enrolled, you will no longer use your password to authenticate. Instead, you will verify your identity by using a PIN or biometrics (like Face ID or Touch ID) directly on your device, tapping your physical FIDO2 security key, or scanning a QR code with your phone and using your phone's unlock method to complete sign-in.
To learn more about passkeys, please see the following KB article: MFA: What is a Passkey?
How Do I Enroll a Passkey for My Penn State Account?
Specific instructions for enrolling and signing in with passkeys can be found in the KB article listed below. You can choose from a list of KBs based on which device type you have available and want to use. Options include smartphones, tablets, computers, password managers, and FIDO2 security keys.
MFA: Multifactor Authentication (MFA) Help and Resources Master List
If you need help choosing, please see the KB article listed below.