3 ms·
FYI, Password + token is a common pattern in systems where hardware/software/OTP tokens were bolted on after the fact. Not just that, but on certain systems (
by oogali 10y ago
FYI,
Password + token is a common pattern in systems where hardware/software/OTP tokens were bolted on after the fact.
Not just that, but on certain systems (think a Windows login screen, or a POP3/IMAP login for your e-mail client), you can't have a 3rd "token" field -- they're hardcoded to ask for just a username and password.
So vendors came up with the idea of appending the token value onto the password, and their middleware (say, a PAM module) splits the provided value into password and token and validates both.
EDIT: That's not to say that Schwab is doing it right (in the front-end, seriously???), but just pointing it it's not as uncommon as you think.
- jodrellblank 10y agoRADIUS backend to network equipment as well. Since RADIUS is old, it doesn't have great password hash/encryption support (afaik), so you don't use it over open networks already, and it's well entrenched / widely supported. So have it with no encryption, and the back-end can pull the password and 2FA code apart and verify both of them, for all kinds of systems which have only a username/password prompt for logins.