Retiring the Cisco Duo Remember Me Feature

Network security is always about finding the optimal balance between a secure network environment and convenience. As bad actors continue to proliferate across the internet, we have watched our peers in higher education strengthen their security postures. It’s time we do the same.

Starting on July 1, 2025, we will be disabling the “Remember Me” feature of Cisco Duo. Once this change is implemented, users will need to complete second-factor authentication each time they connect to one of the University’s single sign-on (SSO) services. While the “Remember Me” feature offers convenience, it introduces significant risks. For example, if a device with “Remember Me” enabled becomes compromised, an attacker could gain unrestricted access to sensitive data and applications. Additionally, because “Remember Me” relies on internet cookies, those files can be stolen from a device and used to access user accounts. For these reasons and more, cookie-based authentication is being phased out as a security standard.

Additional information will be shared as we approach the July 1 change.

See also