Article Intended For
Penn State University employees, students, and other affiliates who want to learn about phishing-resistant multifactor authentication (MFA) and how it protects their Penn State Account.
Introduction
This article provides information regarding phishing-resistant MFA, passkeys, and provides links for how to enroll and use it.
Article Body
What is Phishing-Resistant Multifactor Authentication (MFA)?
Phishing-resistant MFA provides additional protection for your Penn State Account by using sign-in methods that are designed to prevent phishing attacks. While traditional MFA methods, such as Microsoft Authenticator push notifications and number matching provide strong account security, they still rely on a password and are not considered phishing-resistant.
What are Passkeys?
Passkeys are a phishing-resistant technology that replace your password. They cannot be easily stolen or entered into a fraudulent website like a password can. Passkeys can be stored in several ways, including on your smartphone, computer, password manager, or a physical FIDO2 security key.
Once enrolled, you will no longer use your password to authenticate. Instead, you will verify your identity by using a PIN or biometrics (like Face ID or Touch ID) directly on your device, tapping your physical FIDO2 security key, or scanning a QR code with your phone and using your phone's unlock method to complete sign-in.
To learn more about passkeys, please see the following KB article: MFA: What is a Passkey?
How Do I Enroll a Passkey for My Penn State Account?
Instructions on how to enroll and sign in using a passkey for your device type can be found in the following KB articles:
MFA: Which MFA Option Should I Choose?
MFA: Enroll a Passkey With My iPhone or iPad (synced to Apple Passwords)
MFA: Enroll a Passkey With My Android Phone or Tablet (synced to Google Password Manager)
MFA: Enroll a Passkey With a FIDO2 Security Key (Yubikey)