I pointed this out to them over a year ago: http://norcie.com/2013/09/01/schwab-unsafe/ http://norcie.com/2013/09/01/schwab-unsafe/ I went to far as to get in

I pointed this out to them over a year ago: http://norcie.com/2013/09/01/schwab-unsafe/ http://norcie.com/2013/09/01/schwab-unsafe/ I went to far as to get in contact with senior staff members at Schwab to alert them to the issue, and got a pretty condescending response. I mentioned it to a friend at a burrito truck outside the Mozilla office, and soon found out it was a top post on /r/personalfinance. I got a call from Schwab shortly after that. But the rep I talked to just said they were "working on" allowing more characters in the password. I must say though, this post does a great job detailing their 2F solution. I never set it up since it seemed like wearing a fishnet condom given the rest of their security, so I never got to see how bad it is.