They do have it. They call it Two Step Verification and I found it in my account security settings.
Or is it not real 2FA somehow?
Or is it not real 2FA somehow?
The email one has different problems (what if my email's hacked too?)
https://client.schwab.com/clientapps/access/securityCenter#/...
And to enter it, you ... append it to your password?
I'm personally going to hold off on giving them the greenlight here.
>And to enter it, you ... append it to your password?
Are you implying this is wrong somehow? It's a fairly common way to do 2FA and there's nothing wrong with it. On the backend, all it's doing is taking the input, substringing the final 6 characters and inputting that as the code, and then uses the remaining characters as the password input. It's essentially just a shortcut that allows you to log in with one click rather than having to enter your password, click submit, enter a code, then click submit again.
Per the FAQ, if you for some reason don't want to append it to your password, it'll send you to a normal "Enter your 2FA code" form like you're probably used to.
The main issue for me is that the 2FA is locked to using the Symantec VIP 2FA app, which is disappointing from a usability standpoint.
But here's where it can go wrong, using ETrade as a specific example. ETrade appends the 2FA token to your password, but also enforces a password character limit. Yep, that means turning on 2FA reduces your password character limit. From what I hear, it has some surprising behavior if your password is already at the character limit and you turn on 2FA.
(Aside: ETrade has some very sketchy security practices, like apparently letting you use the 2FA token on its own to reset your password (according to a coworker), but that's another discussion.)
FWIW I think 2) is the bigger sin here.