Two-factor authentication with OTP 
One Time Password for staff

What is OTP

The acronym OTP stands for 'One Time Password', a mechanism aimed at making users' online authentication more secure through the use of a secret code that changes each time they log in. To obtain this code, you can use an application (through a smartphone, tablet, pc, etc.) that, every 30 seconds, generates a new one-time code ('token code') to be used to prove your identity from an original configuration key called a 'seed'.

In addition to traditional authentication by means of personal username and password, OTP is part of the 'Multi Factor Authentication' (MFA) systems, whereby a user can only access an online service after authenticating themselves by means of two or more proofs of identity, e.g., by knowing their password and possessing a device authorised to generate OTP.

This mechanism, which has been in use for some time in areas such as home banking, has become necessary for the University's applications as well, in order to more effectively counter the risks of cyber-attacks.

OTP at Ca' Foscari

As of 1st July 2022, OTP shall be required for all staff with a unive account (e.g., professors, researchers, research grant holders, short-term research fellows, foreign language assistants, technical administrative staff, etc.), excluding students. Thereafter, if users have not configured OTP, they will be asked to activate this additional security level when changing their password for the first time.
The OTP is tied to a single unive account: if you have several accounts, you will have to activate an OTP for each of them.

When it comes to most Ca' Foscari online services and applications, in order to authenticate yourself, you will have to enter your username and password and provide a 6-digit one-time code generated by a suitably configured application. As a matter of fact, the OTP system chosen at Ca' Foscari does not use SMSs nor is it tied to a phone number. The code created by the app changes every 30 seconds in order to reinforce security: at each authentication, the code corresponding to the one displayed at that moment by the application must be entered.

The following still work without OTP and thus with simple authentication via username and password: VPN connection, Wi-Fi connection via eduroam or Unive_WiFi networks, access to computers or virtual machines via dedicated protocols such as SSH, RDP or Citrix.

How OTP is activated

The OTP activation procedure must be completed seamlessly. Should you be forced to interrupt it, you will have to repeat it from scratch, as the codes provided change with each new access to the activation web page.

  1. Download the free app Google Authenticator or a similar one on your device from the official store (Google Play for Android devices, App Store for iOS devices):

    When setting up Google Authenticator, please select "Use without an account", otherwise it will not be possible to correctly activate the application.
    The authentication apps we suggest to use are free of charge; please avoid downloading OTP apps that are not free of charge from the stores.

  2. Log on to www.unive.it/gestione-otp [ITA] through a browser: a QR code will be displayed.
  3. Start the app that you downloaded on your device, click on the ( + ) button at the bottom right, select 'Scan a QR code' and scan the previously generated QR code.
  4. Download the pdf document generated at the end of the process and store it safely. It will then be possible to activate an OTP generator on another device in the event of loss, replacement, theft, etc. of the previous device.
    The 'seed' key contained in the pdf must never be disclosed to anyone, not even to the staff of the Computer Services and Telecommunications Area (ASIT).
  5. Only after setting up the app and saving the pdf document in a safe place, click on 'Activate' at www.unive.it/gestione-otp [ITA] to activate two-factor authentication.
    From now on, you will have to enter the OTP code in addition to your username and password to authenticate.

FAQs

To avoid losing or disseminating the information in the document obtained by OTP activation, we advise you to:

  • print it out and put it in a protected and confidential place (e.g., a drawer under lock and key)
  • or store it in pdf format within an encrypted archive protected by a 'strong' password (e.g., as an attachment to a password manager; a compressed file with a password is not sufficient)

Yes, because it enhances security and protects password management.

Yes, because you need it to change your password, keeping your account from becoming locked. Furthermore: not every Unive service can be accessed through SPID.
Changing the password is mandatory: an account with an expired password gets automatically locked, blocking access to all the linked services. After you updated your password, you will be able to use your SPID identity to login to the services that support it.

  1. Check that the OTP has not expired, i.e., no more than 30 seconds have passed since it was generated in the app. If this is the case, simply use the next code displayed by the app.
  2. Check that you have set automatic time synchronisation on your device (e.g., smartphone or tablet). If the time is synchronised manually, it may not be aligned with the actual time: using https://time.is, check that the difference is no greater than 30 seconds.
    Otherwise, set automatic time synchronisation to solve the problem.
  3. If you do not want to change the time of your device, access the Google Authenticator app, click on the menu (3 vertical dots on the top right), select 'Settings' and then 'Time correction for codes'. This way, the app will calculate and save the difference between the manual time on your device and the exact real time. This correction operation has to be redone from time to time or after each manual change of the device time, so it is preferable to solve the problem by setting automatic time synchronisation.

No. If properly configured according to the instructions, the system works regardless of geographical location and time zone.

If you do not activate the OTP system, you will have to use your personal SPID to access your University account and related services, as required by Italian Law Decree No. 76/2020.
You will only be able to use your University credentials for services that do not require OTP (listed above in the ‘OTP at Ca' Foscari’ section).

In unive accounts shared between several co-workers, OTP can be enabled by having all co-workers in that account scan the activation QRcode, so that they can configure the device appropriately.
By having the QRcode scanned but not disclosing the 'seed', the account contact person can maintain control over the employees authorised for access. It should therefore be the responsibility of the unive account contact person not to disclose the document with QRcode and ‘seed’.
If employees access the mail of the shared account via Gmail delegation, it will not be necessary to have the OTP configured for them, as they will continue to view the mail of the shared account via personal authentication. It will then be the sole responsibility of the account contact person to configure the OTP.

The application to generate the OTP code can be reconfigured using the QRCode or 'seed' in the PDF document that you saved during the first OTP activation (see section about "How OTP is activated"). Make sure you download and keep that document safely.
If you no longer have the PDF document containing the QRCode and seed, you can generate a new OTP as follows:

  • access www.unive.it/gestione-otp [ITA] with your personal SPID or CIE (Italian Electronic I.D.) as required by Decree-Law no. 76/2020;
  • click on "Genera un nuovo OTP" (Generate a new OTP);
  • reset the Google Authenticator app with the new QRCode
  • delete the old OTP code from the Google Authenticator app.

If you do not have SPID or CIE access, please request support by opening a ticket [ITA] with ASIT, attaching a copy of a valid ID document.

For security reasons, you must immediately create a new PDF document with the activation code, proceeding as follows:

  • access www.unive.it/gestione-otp [ITA] with your personal SPID or CIE (Italian Electronic I.D.) as required by Decree-Law no. 76/2020;
  • click on "Genera un nuovo OTP" (Generate a new OTP);
  • reset the Google Authenticator app with the new QRCode.

This procedure will create a new PDF document that you should keep safely, as it will contain new QRCodes and 'seeds'. The OTPs generated by the previous configuration will no longer be valid.

If you do not have SPID or CIE access, please request support by opening a ticket with ASIT, attaching a copy of a valid ID document.

  • access www.unive.it/gestione-otp [ITA] with your current OTP code and click on "Genera un nuovo OTP" (Generate a new OTP)
  • reset the Google Authenticator app with the new QRCode.
  • delete your old OTP code from the Google Authenticator app.

This procedure will create a new PDF document that you should keep safely, as it will contain new QRCodes and 'seeds'. The OTPs generated by the previous configuration will no longer be valid.

Although the use of the application installed on a mobile device is strongly recommended, it is also possible to obtain OTP through special browser extensions.
The staff of the ASIT has verified the Two Factor Authenticator extensions for Mozilla Firefox and Authenticator for Mozilla Firefox and Google Chrome.

You can try installing the following app as a Google Authenticator alternative:

This app has been tested by the staff of the Computer Services and Telecommunications Area (ASIT). Its configuration is very similar to the one of Google Authenticator, and this app is available for a wider selection of older smartphones.

Last update: 06/11/2024