3 ms·
Are there any US consumer bank accounts that can be configured for 2FA other than SMS? In the brokerage space, Robinhood accepts TOTP and Fidelity accepts Syma
by closeparen 7y ago
Are there any US consumer bank accounts that can be configured for 2FA other than SMS?
In the brokerage space, Robinhood accepts TOTP and Fidelity accepts Symantec VIP (proprietary TOTP-alike). But I don't know of any checking or savings accounts that can be protected this way.
- RandomBacon 7y agoUSAA
- cvwright 7y agoUgh, USAA's 2-factor solution is such a pain in the butt. You can get a login token from their mobile app, but it's not very easy to find. I really wish they would just support U2F or FIDO.
- T3OU-736 7y agoWells Fargo supports RSA tokens. The HW ones. TOTP or similar? Not so much, sadly. https://twofactorauth.org/ https://twofactorauth.org/ is actually quite decent at tracking that sort of stuff
- js2 7y agoFYI, you can use this utility to get the Symantec TOTP code into a standard TOTP program like Authy or Google Authenticator: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
- closeparen 7y agoWoah, interesting! I thought TOTP used a shared secret rather than asymmetric encryption. The only thing I had to give Fidelity was the credential ID. Is that enough to generate or verify codes? It does that require key material that only Symantec has?
- js2 7y agoThis blog post explains how it works: https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/ https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi... But yes, the original author extracted a pair of shared secrets from the Symantec executable.
- mikem170 7y agoSchwabb gives you an rsa token for the asking.