Understanding how "Remember me" works in Duo Mobile multi-factor authentication
The Remember me feature of Duo MFA works for most people most of the time. However, it is not 100% reliable because the feature relies on web cookies of a particular type, and the web browser you are using must accept this type of cookie. These are common situations in which you may need to authenticate with Duo MFA each time you log in.
Web browser issues
- Allowing cookies
Most web browsers have security and privacy settings that allow you to accept or reject cookies entirely. You must allow cookies to be set by *.northwestern.edu and *.duosecurity.com.
- Tracking or 3rd party cookies
Cookies are often sent back only to the site that initially gave you the cookie. But many web sites also use what are called 3rd party cookies. These are also known as tracking or cross-site cookies, because they allow one web site (e.g., www.cnn.com), to track your visits to another site (e.g., www.facebook.com). Duo's Remember me cookie, although it is not used for tracking or advertising purposes, is indistinguishable from these cookies. More and more browsers are not allowing these cookies by default, though most let you adjust these settings.
- Multiple browsers
If you authenticate with Duo MFA using one browser (e.g., Chrome), then later login via another browser (e.g., Firefox), you will be prompted to authenticate with Duo MFA again. Web browsers do not share cookies with each other.
- Clearing cache/cookies
If you delete Duo's Remember me cookie by manually clearing your browser's cookies/cache, you will have to authenticate with Duo MFA again the next time you log in. Some web browsers can also be configured to clear cookies and/or cache each time they are launched.
- Private or Incognito mode
Most browsers have a private or incognito mode. When you use this, cookies are not saved, website addresses aren’t cached, and several other features are modified. You will always have to authenticate with Duo MFA when using incognito/private mode.
These pop-up windows must provide the same cookie support and settings noted above. If they do not, Duo's Remember me will not work for these applications. Even if Duo's Remember me does work, note that this Remember me cookie will not be shared with the web browser you use for normal tasks (e.g., Chrome, Firefox, Safari).
Your experience with non-browser issues can vary widely based on your device's operating system version, the patches/updates that have been applied, and the vendor-provided client application.