Two-factor authentication policy
Two-Factor Authentication Policy
Why two-step verification is required
As an educational technology platform, Uedu stores large amounts of students' personal data, including AI conversation records, Learning history, Course activity statistics, and learning trait exploration results. These data are highly sensitive and involve students' learning behaviour and personal privacy.
Teachers, TAs and administrators need access to these data during teaching to support teaching improvement and learning outcome analysis. However, if these accounts are protected only by passwords, then once a password is leaked or brute-forced, an attacker can gain extensive access to Student personal data, causing serious privacy infringement.
Two-factor authentication (2FA) adds a second layer of security to the account. Even if the password is leaked, an attacker still cannot pass verification using the dynamic code generated by the Authenticator app, thereby effectively preventing unauthorised access.
Protect student data
The second line of defence for verification
prevents unauthorised access to accounts
Legal Basis
Under our country's Personal Data Protection Act, data holders are explicitly required to adopt security maintenance measures to protect personal data from infringement. The following are the main legal bases for this platform's mandatory 2FA:
Article 18
For personal data files held by public agencies, a designated person should be assigned to carry out security maintenance, to prevent personal data from being stolen, altered, damaged, lost or leaked.
Article 20-1
Where a non-public agency holds personal data files, appropriate security measures shall be taken to prevent personal data from being stolen, altered, damaged, lost or leaked.
Article 48 (Penalties)
Any person who breaches the duty to maintain security shall be fined between NT$200,000 and 20,000,000; if the breach is not remedied by the deadline, successive fines of between NT$150,000 and 15,000,000 shall be imposed for each instance.
Applicable audience and accessible data
The following table lists the range of student data each role can access, together with the corresponding 2FA requirements:
| role | Accessible Student data | 2FA requirements |
|---|---|---|
| System administrator | All user data, system settings and platform-wide statistics | Forced on, cannot be disabled |
| Course Instructor | Course activity statistics, Student AI dialogue records, learning history, Quiz scores, Survey responses | Forced on, cannot be disabled |
| Course TA | Course activity statistics, Student learning history, Forum interaction records | Forced on, cannot be disabled |
| General Student | Only your own data (conversation records, Learning history, grades) | Recommended to enable (not mandatory) |
Technical implementation notes
Uedu adopts the TOTP (Time-based One-Time Password) standard to implement two-step verification, compatible with all mainstream authenticator applications. The main security design is as follows:
TOTP key encrypted storage
Keys are stored using Fernet symmetric encryption, so even if the database is compromised the raw key cannot be obtained
Rescue code SHA-256 hash
10 one-time recovery codes are stored as SHA-256 hashes; the system cannot reconstruct the plaintext
Brute-force protection
Five consecutive verification failures lock the account for 15 minutes, effectively preventing brute-force attempts
Email Reset Cooldown Period
After resetting 2FA via Email, you must wait for a 24-hour cooling-off period to prevent malicious actions
For a more detailed explanation of the security design, please refer to the "Account security mechanisms" section on the Data Security Policy page.
Frequently Asked Questions
How do I set up two-factor authentication?
After logging in, go to the 2FA setup page, use an authenticator app (such as Authy, Google Authenticator or Microsoft Authenticator) to scan the QR Code, enter the 6-digit verification code to complete setup. The system will generate 10 recovery codes; please store them safely.
What should I do if I lose my phone or authenticator app?
You can log in using the recovery code saved when it was enabled; or apply for Email Reset on the login page (effective after a 24-hour cooling-off period); you can also contact the Course Instructor or platform administrator to reset it in the back end. After the reset, the Instructor/TA/administrator account will be required to set up 2FA again immediately.
Why can't I disable 2FA?
If you are an Instructor, TA, or administrator, your account can access students' personal data. Under the security maintenance obligations of the Personal Data Protection Act, the platform must ensure that these accounts are adequately protected. 2FA is one of the most effective account protection measures available, so it cannot be disabled.
Do students also need to set up 2FA?
A standard student account is not mandatory, but we strongly recommend enabling it to protect the security of your personal account. You can enable or disable it yourself on the 2FA settings page.
Still have questions? Please see the FAQ or Contact us.