Hacker News Reader

I might buy it if two factor activation wasn't a one time operation.

As it stands, there's no need to confuse existing users. You just need a separate pathway to activate the token.

THEN you just ask for the token as a step two in the login process. That's actually how Schwab handles things right now.

For some shitty services, like PayPal that don't give you a long-lived auth token, it is an every-time process. :|

As expected, Schwab isn't the only perpetrator of bad two-factor auth. I think PayPal still DOES NOT support two-factor auth on their mobile clients.

Shameless plug of my blog posts about Paypal's terrible two factor auth: