Re:Robinhood to pay $70M for 'systemic supervisory failures'
by toastal on Thursday July 01, 2021 @12:01AM
(#27696159)
I'm happy you brought it up. I read about this a while back (haven't yet prioritized doing it though). More I was commenting on the principle of using a closed-source TOTP product. Reading the reverse engineer blog gave me anxiety. The project had issues in the past when they blocked spoofing a certain Apple device and it's disgusting that this is even a 'thing'.
Re:Robinhood to pay $70M for 'systemic supervisory failures'
by toastal on Friday July 02, 2021 @06:23AM
(#27709807)
I just did this to success. My biggest suggesting in this copy-paste is changing "Google Auth" to "TOTP authenticator". Do not endorse Google products when the open source alternatives like andOTP and pass-otp are great. It's bad enough Schwab is supporting the closed-source Symantec authenticator whose application is not available on GNU/Linux or BSD.
1. install pre-reqs: sudo pip install python-vipaccess && brew install qrencode
2. Run: vipaccess provision -p -t VSMT
This will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website.
3. Save the otpauth://... data into data.txt.
4. (Optional) Modify the issue=Symantec parameter to read issue= Charles%20Schwab Also change VIP%20Access:VSMT123456789 to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app.
5. Run: qrencode -o qr.png -s 15 < data.txt to generate the QR image (qr.png) from your otpauth data file.
6. Scan qr.png with your TOTP app.
7. Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from your TOTP.