4 ms·

I will add: one thing I don't like about schwab is their password/account security. They don't offer real 2FA, for instance.

SaintGhurka 6y ago
They do have it. They call it Two Step Verification and I found it in my account security settings. Or is it not real 2FA somehow?
- cashewchoo 6y ago
  it's email/sms/phone-based. I consider "real 2fa" to be authenticator-based. Not vulnerable to SIM hijacking. The email one has different problems (what if my email's hacked too?)
  - callmekit 6y ago
    Schwab's 2FA is app or hardware token-based. https://www.schwab.com/help/two-factor-authentication https://www.schwab.com/help/two-factor-authentication
    - chrisan 6y ago
      In my account I am only getting the option for "Two-step Verification" https://client.schwab.com/clientapps/access/securityCenter#/main/epass https://client.schwab.com/clientapps/access/securityCenter#/...
      - SaintGhurka 6y ago
        When you hit the "Always at Login" radio button, do you get the "Security Token" option?
        chrisan 6y ago
        Not at this url: https://client.schwab.com/Login/SignOn/CustomerCenterLogin.aspx https://client.schwab.com/Login/SignOn/CustomerCenterLogin.a...
    - cashewchoo 6y ago
      Interesting. You seem to have to contact customer support to get it enabled. And to enter it, you ... append it to your password? I'm personally going to hold off on giving them the greenlight here.
      - rochester46 6y ago
        I was able to enable it myself through the web interface, no contacting customer support required. >And to enter it, you ... append it to your password? Are you implying this is wrong somehow? It's a fairly common way to do 2FA and there's nothing wrong with it. On the backend, all it's doing is taking the input, substringing the final 6 characters and inputting that as the code, and then uses the remaining characters as the password input. It's essentially just a shortcut that allows you to log in with one click rather than having to enter your password, click submit, enter a code, then click submit again. Per the FAQ, if you for some reason don't want to append it to your password, it'll send you to a normal "Enter your 2FA code" form like you're probably used to. The main issue for me is that the 2FA is locked to using the Symantec VIP 2FA app, which is disappointing from a usability standpoint.
        kibibyte 6y ago
        On its own, there's nothing inherently wrong with it, aside from it being a very awkward user experience. But here's where it can go wrong, using ETrade as a specific example. ETrade appends the 2FA token to your password, but also enforces a password character limit. Yep, that means turning on 2FA reduces your password character limit. From what I hear, it has some surprising behavior if your password is already at the character limit and you turn on 2FA. (Aside: ETrade has some very sketchy security practices, like apparently letting you use the 2FA token on its own to reset your password (according to a coworker), but that's another discussion.)
        cashewchoo 6y ago
        FWIW, World of Warcraft has had a sublime 2FA solution for like a decade at this point. So when schwab has 1) weird UX around logging in and 2) you have to contact customer support to enable something that should be standard security functionality in 2020, then yeah, I'm going to hold off on endorsing their 2fa implementation. FWIW I think 2) is the bigger sin here.
dralley 6y ago
A lot of the alternatives aren't much better. Fidelity for example would allow you to input your password as the numerical equivalent (think phone keypad - A, B or C map to "1" and so on). Which basically requires modifying your password before hashing it (and dramatically reducing entropy in the process). I'm not sure if they still do this. http://mattstockton.com/2013/03/20/my-bank-password-is-sort-of-hashed/ http://mattstockton.com/2013/03/20/my-bank-password-is-sort-... I think I recall Vanguard having had something similar but I can't find it in searching, so perhaps not.
- karlding 6y ago
  According to Fidelity's website [0] they still do so ("You'll be asked to enter your username and password using the keypad on your phone."). I basically assume any financial institution that provides support for the old "telephone banking" methods via DTMF tones either stores your password in plaintext or a hashed version that reduces entropy. I'm honestly surprised hackers haven't gotten sophisticated enough to bruteforce these reduced entropy login passwords using a Twilio account. [0] https://www.fidelity.com/customer-service/phone-numbers/overview https://www.fidelity.com/customer-service/phone-numbers/over...
throw182982 6y ago
I use a Verisign (Symantec?) VIP token on my account. Several years ago they actually mailed me the key fob, later they let me give them my mobile token's serial number (generated by python-vipaccess) so I could use that instead.
dmoy 6y ago
The only US brokerage that offers real 2fa is vanguard (last I checked), and even they mess it up by allowing sms fallback. It still will allow you to avoid phishing if you never use the sms fallback, but it does make you vulnerable to sim attacks of the variety "convince phone store rep to replace 'your' lost sim card"
- jrib 6y ago
  What makes Schwab's implementation with a hard token not "real"?
  - dmoy 6y ago
    Because it's still trivially vulnerable to phishing Any kind of otp/totp leaves you with too much risk
jrib 6y ago
They offer a physical token if you call and ask for it. They also offer the option of using some Symantec app as a second factor but I've never tried that. https://www.schwab.com/help/two-factor-authentication https://www.schwab.com/help/two-factor-authentication

SaintGhurka 6y ago

They do have it. They call it Two Step Verification and I found it in my account security settings. Or is it not real 2FA somehow?

cashewchoo 6y ago
it's email/sms/phone-based. I consider "real 2fa" to be authenticator-based. Not vulnerable to SIM hijacking. The email one has different problems (what if my email's hacked too?)
- callmekit 6y ago
  Schwab's 2FA is app or hardware token-based. https://www.schwab.com/help/two-factor-authentication https://www.schwab.com/help/two-factor-authentication
  - chrisan 6y ago
    In my account I am only getting the option for "Two-step Verification" https://client.schwab.com/clientapps/access/securityCenter#/main/epass https://client.schwab.com/clientapps/access/securityCenter#/...
    - SaintGhurka 6y ago
      When you hit the "Always at Login" radio button, do you get the "Security Token" option?
      - chrisan 6y ago
        Not at this url: https://client.schwab.com/Login/SignOn/CustomerCenterLogin.aspx https://client.schwab.com/Login/SignOn/CustomerCenterLogin.a...
  - cashewchoo 6y ago
    Interesting. You seem to have to contact customer support to get it enabled. And to enter it, you ... append it to your password? I'm personally going to hold off on giving them the greenlight here.
    - rochester46 6y ago
      I was able to enable it myself through the web interface, no contacting customer support required. >And to enter it, you ... append it to your password? Are you implying this is wrong somehow? It's a fairly common way to do 2FA and there's nothing wrong with it. On the backend, all it's doing is taking the input, substringing the final 6 characters and inputting that as the code, and then uses the remaining characters as the password input. It's essentially just a shortcut that allows you to log in with one click rather than having to enter your password, click submit, enter a code, then click submit again. Per the FAQ, if you for some reason don't want to append it to your password, it'll send you to a normal "Enter your 2FA code" form like you're probably used to. The main issue for me is that the 2FA is locked to using the Symantec VIP 2FA app, which is disappointing from a usability standpoint.
      - kibibyte 6y ago
        On its own, there's nothing inherently wrong with it, aside from it being a very awkward user experience. But here's where it can go wrong, using ETrade as a specific example. ETrade appends the 2FA token to your password, but also enforces a password character limit. Yep, that means turning on 2FA reduces your password character limit. From what I hear, it has some surprising behavior if your password is already at the character limit and you turn on 2FA. (Aside: ETrade has some very sketchy security practices, like apparently letting you use the 2FA token on its own to reset your password (according to a coworker), but that's another discussion.)
      - cashewchoo 6y ago
        FWIW, World of Warcraft has had a sublime 2FA solution for like a decade at this point. So when schwab has 1) weird UX around logging in and 2) you have to contact customer support to enable something that should be standard security functionality in 2020, then yeah, I'm going to hold off on endorsing their 2fa implementation. FWIW I think 2) is the bigger sin here.

dralley 6y ago

A lot of the alternatives aren't much better. Fidelity for example would allow you to input your password as the numerical equivalent (think phone keypad - A, B or C map to "1" and so on). Which basically requires modifying your password before hashing it (and dramatically reducing entropy in the process). I'm not sure if they still do this. http://mattstockton.com/2013/03/20/my-bank-password-is-sort-of-hashed/ http://mattstockton.com/2013/03/20/my-bank-password-is-sort-... I think I recall Vanguard having had something similar but I can't find it in searching, so perhaps not.

karlding 6y ago
According to Fidelity's website [0] they still do so ("You'll be asked to enter your username and password using the keypad on your phone."). I basically assume any financial institution that provides support for the old "telephone banking" methods via DTMF tones either stores your password in plaintext or a hashed version that reduces entropy. I'm honestly surprised hackers haven't gotten sophisticated enough to bruteforce these reduced entropy login passwords using a Twilio account. [0] https://www.fidelity.com/customer-service/phone-numbers/overview https://www.fidelity.com/customer-service/phone-numbers/over...

throw182982 6y ago

I use a Verisign (Symantec?) VIP token on my account. Several years ago they actually mailed me the key fob, later they let me give them my mobile token's serial number (generated by python-vipaccess) so I could use that instead.

dmoy 6y ago

The only US brokerage that offers real 2fa is vanguard (last I checked), and even they mess it up by allowing sms fallback. It still will allow you to avoid phishing if you never use the sms fallback, but it does make you vulnerable to sim attacks of the variety "convince phone store rep to replace 'your' lost sim card"

jrib 6y ago
What makes Schwab's implementation with a hard token not "real"?
- dmoy 6y ago
  Because it's still trivially vulnerable to phishing Any kind of otp/totp leaves you with too much risk

jrib 6y ago

They offer a physical token if you call and ask for it. They also offer the option of using some Symantec app as a second factor but I've never tried that. https://www.schwab.com/help/two-factor-authentication https://www.schwab.com/help/two-factor-authentication