Univerzita Tomáše Bati ve Zlíně

MFA (Multi-Factor Authentication) is a security measure that requires more than just a username and password to log in. In addition to your password, you must also enter a one-time verification code from an authentication app. This ensures that your account remains secure even if someone discovers or steals your password.

What are the main benefits of MFA?

• Significantly reduces the risk of user account compromise.
• Protects corporate data and systems.
• Prevents unauthorized access in the event of a password leak.
• Is one of the most effective security measures used by organizations worldwide.

OTP (One-Time Password), also known as TOTP (Time-based One-Time Password), is a one-time code generated based on:

• a secret key saved during registration,
• the current time.

During the initial setup, a secret key is stored in the authentication app (usually by scanning a QR code). Every 30 seconds, the app uses this key and the current time to calculate a new six-digit code.

Key features:

• the code is valid for only a short period of time and can be used only once,
• only the server and your authentication app know the same secret key,
• no internet connection is required to generate the code.

An authentication app is a program that generates one-time OTP codes.

Common authentication apps include, for example:

• Microsoft Authenticator
• Google Authenticator

The app’s sole purpose is to generate verification codes for logging in.
More information about authentication apps, including download links, is available on a separate webpage.

No.
A smartphone is the most common option because people usually have it with them, but it’s not the only one.

OTP codes can also be generated:

• in a desktop app on a computer,
• in a specialized password manager that supports TOTP,
• on certain hardware security devices.

Important notice

For security reasons, it is recommended that you keep your second factor separate from the device you use to log in. Therefore, if you use a desktop app on the same computer you use to log in, your security is slightly weaker than if you used a separate phone or hardware token.

You can use the desktop authentication app on your computer.

No.
Standardní autentizační aplikace slouží pouze ke generování ověřovacích kódů.

Typically:

• it does not track your location,
• it does not access your photos,
• it does not access your messages,
• it does not allow your employer to remotely control your phone,
• it does not allow your employer to view the contents of your phone.

The app generates codes locally, directly on the device.

The generation of OTP codes itself works without sending login credentials or the contents of your phone.
Some apps may communicate with their servers for purposes such as:

• backing up accounts,
• synchronizing across devices,
• app updates.

However, this does not mean that the organization gains access to the contents of your phone. The extent of communication depends on the specific app and its settings.

It often does during the initial setup. This is because it needs to scan a QR code that contains a secret key for setting up the account. Once registration is complete, most apps no longer need the camera. The secret key can usually be entered manually as a text string.

No, not for generating OTP codes.
After the initial setup, the app can generate codes even:

• without mobile data,
• without Wi-Fi,
• in airplane mode.

The device just needs to have the correct time set.

Contact IT support as soon as possible.

It is usually possible to:

• reset MFA,
• set it up on a new device.

Before switching devices, you should:

1. install the authentication app on your new device
2. view your MFA key on the user account management portal
3. add the account to your new device by scanning the displayed QR code

 
Alternatively, transfer the authentication app to your new device, including the settings, following the manufacturer’s instructions.
If you no longer have your old phone, contact IT support.

Yes.
Authentication apps typically support multiple independent accounts at the same time and can generate separate codes for different services.

Yes.
You can have the authentication app installed on both your phone and a backup device—such as another phone or a computer. This can make it easier to regain access if one device is lost or malfunctions.

Yes, generally speaking.

OTP codes:

• are not dependent on a mobile carrier,
• cannot be intercepted by SMS forwarding,
• work even without a mobile signal.

That is why they are now considered a more secure option for multi-factor authentication.

Most common causes:

• incorrect time settings on your device,
• using an expired code,
• typing the code incorrectly,,
• incorrect account settings in the authentication app.

Check your device’s time (ideally, enable automatic time synchronization) and try a new code. If the problem persists, contact IT support.

Even a very strong password can be:

• stolen in a data breach,
• obtained through a phishing attack,
• accidentally disclosed,
• exploited by malware.

MFA adds an extra layer of security, so simply knowing the password isn’t enough for an attacker.

Typically:

1. log in to the system,
2. scan the QR code using the authentication appí,
3. the app will start generating OTP codes,
4. enter one code to verify that the setup is correct.

 
After that, whenever you log in where it is required, you will enter the current verification code in addition to your password.

No.

Using the authentication app on its own:

• does not provide access to the phone’s content,
• does not provide access to call history,
• does not provide access to photos,
• does not provide access to personal apps,
• does not allow tracking of the user’s location.

The authentication app is not a communication tool between the organization and the phone. It functions more like a calculator that generates one-time OTP codes based on a stored secret key and the current time.