python-vipaccess

Etrade (probably some other companies?) uses Symantec VIP, which is a proprietary TOTP client. I was really glad to have found a project that allows me top stop using it and instead utilize other standard TOTP clients. https://github.com/dlenski/python-vipaccess https://gist.github.com/jarbro/ca7c9d3eebba1396d53b4a7228575...

So wait: you don't want to pay Apple $99 and you don't want to pay for one of the apps that generates a pass for you, but you'll extract the cert from one of those apps thereby piggybacking on another developer's $99 payment to Apple. That's uncool. On a slightly related note: a site I login to regularly uses Semantic VIP Access for 2FA. You can convert these to standard TOTP codes so that you can load them into the Apple Keychain or whatever other TOTP program you prefer: https://github.com/dlenski/python-vipaccess

> If Schwab would fix their account security to allow plain TOTP instead of the scam that is Symantec VIP Symantec VIP is just TOTP with a proprietary app/enrollment process. It has been reverse engineered [1], allowing you to use any TOTP app. I have been accessing Schwab and other banking sites this way for years. [1] https://github.com/dlenski/python-vipaccess

Symantec VIP is TOTP under the hood. https://github.com/dlenski/python-vipaccess

My apologies, I guess I read these bits wrong. https://github.com/dlenski/python-vipaccess/blob/cc4366f7bce... https://github.com/dlenski/python-vipaccess/issues/39#issuec...

Fortunately you can undo these steps for $BANK1 and use your TOTP authenticator of choice: https://github.com/dlenski/python-vipaccess e: I think you added a reference to this as I was writing my comment :)

Personally, I don't, I explicitly and intentionally keep my Email, Password Manager and 2FA providers all distinct and separate. (This was very useful for extracting the TOTP secret out of the Symantec VIP 2FA system: https://github.com/dlenski/python-vipaccess) At work, we do for non-person accounts. It's non-ideal, but I don't want to manage two separate systems for storing that data and trying to keep them in sync. The password vault system itself has a hard requirement for 2FA to download the vault.

Never interacted with Symantec’s system and thought it was one of the rare non-standard exceptions, but apparently it’s just normal TOTP with extra funky lock-in at the enrolment stage[1,2]. [1] https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi... (expired cert warning) [2] https://github.com/dlenski/python-vipaccess

I’m not sure what the three are, but I was able to use Authy for all of my TOTP codes before I moved them all to the iOS/macOS keychain which now has TOTP support combined with autofill into the TOTP field in Safari. But in any case, what I wanted to let you know is that you can convert the Symantec VIP token into a standard TOTP token. https://github.com/dlenski/python-vipaccess

python-vipaccess might interest you. I used it for both PayPal and eBay at one point. https://github.com/dlenski/python-vipaccess

Is this the Symantec script you're referring to? https://github.com/dlenski/python-vipaccess Once you follow those steps you can generate codes from any TOTP system (Yubi, Android, etc).

There’s also a tool that converts Symantec VIP Access tokens to standard TOTP tokens: https://github.com/dlenski/python-vipaccess

If you trust python-vipaccess[0], you can use it to provision the token to load into your preferred TOTP app. It’s not a supported method but if you (or someone coming across this later) want to use another app it’s an option :) From WilsonHammer on Reddit[1]: 1) Install pip, a python package manager, using your OS package manager. 2) Install python-vipaccess by executing `pip install --user python-vipaccess` 3) Execute `vipaccess provision -p -t VSMT` - this will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website. 4) Save the `otpauth://...` data into data.txt. 4.5) (Optional) Modify the `issuer=Symantec` parameter to read `issuer=Charles%20Schwab` Also change `VIP%20Access:VSMT123456789` to your Schwab online

Was it Symantec? You can import that into Authy/Google Authenticator/1Password if you want. It's good at least for backup. https://github.com/dlenski/python-vipaccess

I used this Python library to create a TOTP for my bank’s Symantec VIP login: https://github.com/dlenski/python-vipaccess I then can store it in my 1Password which provides the new code every 30 seconds.