Hacker News Reader

Comment by toastal | Hacker News Reader

I love that you get on a call with real native speaker in the US with Schwab; that part of customer support has been stellar. I like that they cover international ATM fees too.

I don't care for how they handle security though. I really wish they supported WebAuthn or at least TOTP that didn't require Symantec's proprietary TOPT solution. I wish they supported PGP for messages as well (I know those GMail users are having their financial data read by Google). When I asked about what "SchwabSecure" really is and what sort of encryption they use gave me marketing fluff, even stating "The reason you may not find more detailed information available online which supports this is so that we can prevent criminals from obtaining this information, and using that to get a foothold"--as opposed to my recent evaluation of email providers to see the competition who could provide the MOST transparency about how they set up their security.

View on HN

You can extract the Symantec TOTP secret and use normal apps with it. This guide is from a reddit comment and I revised it slightly:

1. install pre-reqs: sudo pip install python-vipaccess && brew install qrencode

2. Run: vipaccess provision -p -t VSMT

This will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website.

3. Save the otpauth://... data into data.txt.

4. (Optional) Modify the issue=Symantec parameter to read issue= Charles%20Schwab Also change VIP%20Access:VSMT123456789 to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app.

5. Run: qrencode -o qr.png -s 15 < data.txt to generate the QR image (qr.png) from your otpauth data file.

6. Scan qr.png with your TOTP app.

7. Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from your TOTP.

I'm happy you brought it up. I read about this a while back (haven't yet prioritized doing it though). More I was commenting on the principle of using a closed-source TOTP product. Reading the reverse engineer blog gave me anxiety. The project had issues in the past when they blocked spoofing a certain Apple device and it's disgusting that this is even a 'thing'.

I just did this to success. My biggest suggesting in this copy-paste is changing "Google Auth" to "TOTP authenticator". Do not endorse Google products when the open source alternatives like andOTP and pass-otp are great. It's bad enough Schwab is supporting the closed-source Symantec authenticator whose application is not available on GNU/Linux or BSD.

The unlimited ATM fee reimbursement from Charles Schwab is amazing, especially for international travel. My brother just spent 3 years living in Australia and was able to withdraw from Charles Schwab and then deposit into his Australian account with zero fees and a better exchange rate than any other service available to him.

If you are concerned about security, you can just leave a couple of hundred bucks in there for whenever you need cash and push funds to it from your main bank to top it up.

I love Schwab but agree on the security front. They tried to push everyone to use their voice auth for phone verification. I want more security not less lol. I remember several years ago, they didn't support special characters in passwords. Hopefully that has chanced.

Not living in the US, if Schwab blocks Google Voice like PayPal did, I would be pretty SOL

> I wish they supported PGP for messages as well

Does anyone support PGP for messages?

some crypto exchanges do

Kraken does.

Encrypting your "here's your trade confirmation for ACME" and "you were late on your credit card payment" from your email provider would be good.

The only major company I know that even has the option for PGP on email is Facebook. It works quite well and was pretty easy to set up, so long as you don't use a webmail client or your phone.

Even Facebook does. Facebook.

"I love that you get on a call with real native speaker"

Wow! Seriously? How do you feel the same way about the people you work with, if they aren't native speakers?

Talking over the phone, which doesn't have great voice quality to begin with, about a potentially stressful and time critical situation is not something accents help with there is nothing wrong with that statement.

A counfounder here is that a strong accent is correlated with outsourcing customer support to low-cost providers to companies with far-away, underpaid staff who lack cultural context and social power within the company they nominally work for.

Personally, I think the much bigger problem is the shitty outsourcing. But semi-sensical corporatese excuse-making is definitely not improved by language and accent barriers.

Thanks for expressing what I was trying to figure out how to put into words. I feel no animosity towards the folks stuffed in a call center for crap wages. I'm irritated with the company that outsourced their support to India and pays them crap wages to try to navigate technology that they don't have adequate training for and at least have no real power to fix.

I mean I had a fun conversation with an older lady who was living in my birth state. This made a MUCH better experience than having a purely technical call.

How do you function in a remote first world, where most of your team joins calls over Slack or Teams? It’s weird that someone painstakingly learnt English, but you don’t can’t put in the effort to listen and understand.

It’s a bit of a stretch to say someone who speaks with a thick accent in grammatically questionable English has “learnt” English. One can respect the effort while at the same time being incredibly frustrated with having to carry an additional cognitive load when attempting to communicate with someone ill-equipped to do so. There’s absolutely nothing wrong with that.

Wouldn’t a fluent or native-level speaker be sufficient?

This is such a ridiculous thing to get annoyed about. I work with a bunch of Croatians; do you really think they prefer that I speak English (US), or would they like it more if I were fluent in Croatian?

Yes, it is also difficult to work with people in person who aren’t native speakers, although over the phone is especially challenging.

If I'm calling support, I'm probably not in the mood for anything being frustrating or confusing. I spend every day in countries where English isn't the primary language, but in face-to-face or chat or even video call, there are ways to indicate nonverbal cues. I have to take phone calls from delivery men when bare know any English and I feel sorry for them having to be asked to wade through my attempt to speak their language or my English because they don't get paid enough for that.

On the otherhand my (massive) bank sure as heck better have the money to afford good native support. And for my beefs with Schwab, this they do a very good job at.

Reply on news.ycombinator.com