1. install pre-reqs: sudo pip install python-vipaccess && brew install qrencode
2. Run: vipaccess provision -p -t VSMT
This will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website.
3. Save the otpauth://... data into data.txt.
4. (Optional) Modify the issue=Symantec parameter to read issue= Charles%20Schwab Also change VIP%20Access:VSMT123456789 to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app.
5. Run: qrencode -o qr.png -s 15 < data.txt to generate the QR image (qr.png) from your otpauth data file.
6. Scan qr.png with your TOTP app.
7. Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from your TOTP.
If you are concerned about security, you can just leave a couple of hundred bucks in there for whenever you need cash and push funds to it from your main bank to top it up.
Does anyone support PGP for messages?
Encrypting your "here's your trade confirmation for ACME" and "you were late on your credit card payment" from your email provider would be good.
Wow! Seriously? How do you feel the same way about the people you work with, if they aren't native speakers?
Personally, I think the much bigger problem is the shitty outsourcing. But semi-sensical corporatese excuse-making is definitely not improved by language and accent barriers.
On the otherhand my (massive) bank sure as heck better have the money to afford good native support. And for my beefs with Schwab, this they do a very good job at.
I don't care for how they handle security though. I really wish they supported WebAuthn or at least TOTP that didn't require Symantec's proprietary TOPT solution. I wish they supported PGP for messages as well (I know those GMail users are having their financial data read by Google). When I asked about what "SchwabSecure" really is and what sort of encryption they use gave me marketing fluff, even stating "The reason you may not find more detailed information available online which supports this is so that we can prevent criminals from obtaining this information, and using that to get a foothold"--as opposed to my recent evaluation of email providers to see the competition who could provide the MOST transparency about how they set up their security.