What is Multi-Factor Authentication? Why is it asking me for a code when I login?

Introduction

TREs are the ‘Safe Setting’ solution to conduct research on sensitive or confidential data. As such, there is a high degree of enhanced security required to safeguard access. Whilst some websites only require a username and password to log-in, it is possible for someone with malicious intent to guess your password, or for the website user to share the credentials with a colleague. To prevent either of these, we use Multi-Factor Authentication, i.e. an extra factor. Authentication “factors” generally fall into the following three categories:

• Something the user has - A physical object which the user has access to, and can prove they have access to during login.

• Something the user knows - Something they remember, but should keep a secret, such as your password.

• Something the user is - Such as your finger print or retina.

HIC TRE log-in process

We rely on the first two authentication factors to ensure safe access to our TRE: something you have and something you know. You will login with your username and password, which should remain confidential, and is therefore something only you know.

For the second factor, you will need your phone for generating authentication codes. We use TOTP (Time-based One Time Password) which can be generated using Google (Android or Apple iOS) or Microsoft Authenticator (Android or Apple iOS) apps (which you may need to install).

The first time you login to the TRE, you will set up a OTP (One Time Password) by scanning a QR code with your authenticator app. This QR code includes information such as the website name, along with a pre-shared key, which is used to generate future codes.

The next time you login to the TRE, you will be asked to enter a 6-digit OTP from the authenticator app.

 Related articles