I'm glad I read your post. I didn't realize Fidelity switched to allowing standard TOTP apps. This is so much better than Symantec VIP, as you note, because you can use it on multiple devices. I especially like being able to run a TOTP app on my desktop, so, like you, I don't have to go get my phone from the other room. Plus, it's just annoying to be forced to uses Symantec's app, when one is already using another authenticator app for most other things.Ultimately when Fidelity made the change a month or so back to support standard TOTP 2FA, I switched from VIP so I could have the TOTP code on multiple devices, and register a personal device as not needing the TOTP code. I acknowledge that using standard TOTP and trusting my personal devices is more convenient, but less secure than using VIP.
What makes you say, though, that standard TOTP less secure than Symantec VIP?
As far as I understand, VIP was just a standard TOTP, except designed in a way to lock you into their app. Rather than getting the key or qr code to set things up directly from Fidelity, VIP used a one time code generated form their backend to the app that you gave to Fidelity, so that Fidelity would be synced to the right key for generating the one time codes for your account. But really all it was doing, once setup, was sending the exact same key to it's app that could be used by any authenticator app. In fact, there is a someone on github who reverse engineered Symantec VIP and figured out a way to get the key from Symantec, so that you could just using any authenticator app anyway.
Statistics: Posted by cb474 — Sun Nov 03, 2024 1:23 am — Replies 7412 — Views 1426777