Why 8? IIRC it is now recommended to do 10-12 (at a minimum) and since it's autogenerated, might as well make it 20+chars if the site will accept it.

Also, you are assuming that Schwab rate-limits login attempts. Given their dismal password policy, do you think that's a safe/reasonable assumption?