A lot of the alternatives aren't much better. Fidelity for example would allow you to input your password as the numerical equivalent (think phone keypad - A, B or C map to "1" and so on). Which basically requires modifying your password before hashing it (and dramatically reducing entropy in the process).

I'm not sure if they still do this.

http://mattstockton.com/2013/03/20/my-bank-password-is-sort-...

I think I recall Vanguard having had something similar but I can't find it in searching, so perhaps not.

According to Fidelity's website [0] they still do so ("You'll be asked to enter your username and password using the keypad on your phone.").

I basically assume any financial institution that provides support for the old "telephone banking" methods via DTMF tones either stores your password in plaintext or a hashed version that reduces entropy. I'm honestly surprised hackers haven't gotten sophisticated enough to bruteforce these reduced entropy login passwords using a Twilio account.

[0] https://www.fidelity.com/customer-service/phone-numbers/over...

They do have it. They call it Two Step Verification and I found it in my account security settings.

Or is it not real 2FA somehow?

it's email/sms/phone-based. I consider "real 2fa" to be authenticator-based. Not vulnerable to SIM hijacking.

The email one has different problems (what if my email's hacked too?)

Schwab's 2FA is app or hardware token-based. https://www.schwab.com/help/two-factor-authentication

In my account I am only getting the option for "Two-step Verification"

https://client.schwab.com/clientapps/access/securityCenter#/...

When you hit the "Always at Login" radio button, do you get the "Security Token" option?

Not at this url: https://client.schwab.com/Login/SignOn/CustomerCenterLogin.a...

Interesting. You seem to have to contact customer support to get it enabled.

And to enter it, you ... append it to your password?

I'm personally going to hold off on giving them the greenlight here.

I was able to enable it myself through the web interface, no contacting customer support required.

>And to enter it, you ... append it to your password?

Are you implying this is wrong somehow? It's a fairly common way to do 2FA and there's nothing wrong with it. On the backend, all it's doing is taking the input, substringing the final 6 characters and inputting that as the code, and then uses the remaining characters as the password input. It's essentially just a shortcut that allows you to log in with one click rather than having to enter your password, click submit, enter a code, then click submit again.

Per the FAQ, if you for some reason don't want to append it to your password, it'll send you to a normal "Enter your 2FA code" form like you're probably used to.

The main issue for me is that the 2FA is locked to using the Symantec VIP 2FA app, which is disappointing from a usability standpoint.

On its own, there's nothing inherently wrong with it, aside from it being a very awkward user experience.

But here's where it can go wrong, using ETrade as a specific example. ETrade appends the 2FA token to your password, but also enforces a password character limit. Yep, that means turning on 2FA reduces your password character limit. From what I hear, it has some surprising behavior if your password is already at the character limit and you turn on 2FA.

(Aside: ETrade has some very sketchy security practices, like apparently letting you use the 2FA token on its own to reset your password (according to a coworker), but that's another discussion.)

FWIW, World of Warcraft has had a sublime 2FA solution for like a decade at this point. So when schwab has 1) weird UX around logging in and 2) you have to contact customer support to enable something that should be standard security functionality in 2020, then yeah, I'm going to hold off on endorsing their 2fa implementation.

FWIW I think 2) is the bigger sin here.

You can optionally input it at the end of your password. If you don't then they will prompt you for it. The option to append it to your password when logging in saves you from having to fill out two input boxes.

For me, it sends me to a secondary login page that asks specifically for the Symantec VIP or hardware token. If they are appending it to the end of my password, it's not evident to me.

They offer a physical token if you call and ask for it. They also offer the option of using some Symantec app as a second factor but I've never tried that.

https://www.schwab.com/help/two-factor-authentication

The only US brokerage that offers real 2fa is vanguard (last I checked), and even they mess it up by allowing sms fallback.

It still will allow you to avoid phishing if you never use the sms fallback, but it does make you vulnerable to sim attacks of the variety "convince phone store rep to replace 'your' lost sim card"

What makes Schwab's implementation with a hard token not "real"?

Because it's still trivially vulnerable to phishing

Any kind of otp/totp leaves you with too much risk

I use a Verisign (Symantec?) VIP token on my account. Several years ago they actually mailed me the key fob, later they let me give them my mobile token's serial number (generated by python-vipaccess) so I could use that instead.