Vanguard offers login security code

KyleAAA · Post by **KyleAAA** » Sun Nov 23, 2014 11:00 am

lululu wrote:
whadyaknow wrote:Sweet. This is a great start. Another way to do this is automated voice calls; but that's more expensive than sending texts. In the spirit of keeping costs low, I'll gladly accept this text-only implementation from Vanguard.
How much more expensive can it be, when no humans are involved? And yet financial institutions in my state with 1/1000 the assets of Vanguard can manage to provide this service to all their customers, not just people with text capability.

Extremely. Humans will have to be involved to build the thing. SMS integration is trivial, hence cheap. Voice integration is not trivial, hence not cheap.

whadyaknow · Post by **whadyaknow** » Sun Nov 23, 2014 3:45 pm

KyleAAA wrote:
lululu wrote:
whadyaknow wrote:Sweet. This is a great start. Another way to do this is automated voice calls; but that's more expensive than sending texts. In the spirit of keeping costs low, I'll gladly accept this text-only implementation from Vanguard.
How much more expensive can it be, when no humans are involved? And yet financial institutions in my state with 1/1000 the assets of Vanguard can manage to provide this service to all their customers, not just people with text capability.
Extremely. Humans will have to be involved to build the thing. SMS integration is trivial, hence cheap. Voice integration is not trivial, hence not cheap.

Most financial institutions will use a vendor to do automated voice calls. For a company the size of Vanguard, using a vendor would be very expensive in absolute terms. I'm talking about hundreds of thousands of dollars per month (conservative estimate). So they'd have to build it themselves, which will cost much more than implementing a text based 2-fac system. The marginal return on building this system (which only affects folks who don't have a text plan or don't use a service like Google Voice) is quite less. I'm OK that Vanguard decided against it.

astrohip · Post by **astrohip** » Sun Nov 23, 2014 6:58 pm

Thanks for posting this info. Signed up.

rai · Post by **rai** » Sun Nov 23, 2014 8:59 pm

ddunca1944 wrote:Thanks for posting this. I've just activated mine.

MuchMoore · Post by **MuchMoore** » Sun Nov 23, 2014 10:20 pm

How does this affect third-party logins such as Mint.com or PersonalCapital.com ?

vitaflo · Post by **vitaflo** » Sun Nov 23, 2014 11:10 pm

I'll turn this on if/when they add it to Google Authenticator. Until then I'm not paying for texts or some other round about silly way to get them.

Rob5TCP · Post by **Rob5TCP** » Mon Nov 24, 2014 9:45 am

Signed up, I have mentioned this in every phone call I've had with vanguard over the past year.

astrohip · Post by **astrohip** » Mon Nov 24, 2014 9:56 am

Rob5TCP wrote:Signed up, I have mentioned this in every phone call I've had with vanguard over the past year.

And you thought they weren't listening!

heartwood · Post by **heartwood** » Mon Nov 24, 2014 12:46 pm

Sorry if I missed it in this chain of posts, but is there any discussion of how or if this applies to the Vanguard smartphone app?

I use that frequently to deposit checks. Do I need a code? Where does that go since I'm using my cell that receives the text.

Edit: Thanks to indexfundfan for posting this information.

2nd Edit: I just tried logging in via the app; no code required. I then tried the online access via my laptop browser and got the code requirement.

3rd edit: I then tried vanguard via the chrome browser on my smartphone. I got the code requirement there, sent to the smartphone.

4th: Funny, Vanguard says "When you set up this service, you choose whether you want to receive a security code every time you log on to vanguard.com or our mobile apps or only when we don't recognize the device that you're using." Yet I can use their mobile app without triggering the code requirement.

newkidontheblock · Post by **newkidontheblock** » Mon Nov 24, 2014 1:18 pm

I wonder what this will do to the financial aggregation services like Mint.
I have been using Mint for a long time and like the convenience of being able to view all my accounts in one place.
Is there Mint to gather information from Vanguard once I have enabled two factor auth?
I will enable two factor auth even if Mint is broken but I was curious if somebody has already done this.

Thanks

KyleAAA · Post by **KyleAAA** » Mon Nov 24, 2014 5:24 pm

heartwood wrote: 4th: Funny, Vanguard says "When you set up this service, you choose whether you want to receive a security code every time you log on to vanguard.com or our mobile apps or only when we don't recognize the device that you're using." Yet I can use their mobile app without triggering the code requirement.

Do they have a separate configuration for the mobile app? Theoretically, 2 factor would be superflous for a mobile app since they can probably tie access to your specific device.

heartwood · Post by **heartwood** » Mon Nov 24, 2014 7:00 pm

KyleAAA wrote:
heartwood wrote: 4th: Funny, Vanguard says "When you set up this service, you choose whether you want to receive a security code every time you log on to vanguard.com or our mobile apps or only when we don't recognize the device that you're using." Yet I can use their mobile app without triggering the code requirement.
Do they have a separate configuration for the mobile app? Theoretically, 2 factor would be superflous for a mobile app since they can probably tie access to your specific device.

I don't know what you mean by "separate configuration." It's their app on an android phone. I launch the app, enter in my user name and PW, same as online in my laptop browser. I've activated code on the account, but the app doesn't ask for one. I also tried it for my account on my wife's phone in the app and it does not ask for a code their either. But take a look at the above Vanguard quote. They're saying it should be the same in "our mobile apps", not me.

crg11 · Post by **crg11** » Mon Nov 24, 2014 8:45 pm

newkidontheblock wrote:I wonder what this will do to the financial aggregation services like Mint.
I have been using Mint for a long time and like the convenience of being able to view all my accounts in one place.
Is there Mint to gather information from Vanguard once I have enabled two factor auth?
I will enable two factor auth even if Mint is broken but I was curious if somebody has already done this.

I received a code via SMS when having Mint sync up this morning. It doesn't appear that Mint will sync up now with Vanguard and I don't see a way to update Mint with this code.

My guess is Mint will need to roll out an update on their end to support Vanguard in this configuration.

rhlhj · Post by **rhlhj** » Tue Nov 25, 2014 11:58 am

I signed up for the service yesterday and logged in from a computer at work. Since then, I've received about 10 additional codes that did not seem to be initiated from a login attempt.

Has anyone else had this problem?

xenial · Post by **xenial** » Tue Nov 25, 2014 12:07 pm

rhlhj wrote:I signed up for the service yesterday and logged in from a computer at work. Since then, I've received about 10 additional codes that did not seem to be initiated from a login attempt.

Has anyone else had this problem?

You might want to call Vanguard. Your receipt of codes you didn't request suggests that someone else could be trying to access your account. Actually, the explanation is probably more mundane, but it's worthwhile to understand what's happening.

S&L1940 · Post by **S&L1940** » Tue Nov 25, 2014 12:16 pm

toto238 wrote:
lululu wrote:Suck eggs, you people with no text capabilities, signed Vanguard.
You can use Google Voice with it. Or alternatively, join the 21st century and get a cell phone.

so this is not available for those of us still mired in 20th century cutting edge technology like a desktop PC? (With Windows 8.1).

rkhusky · Post by **rkhusky** » Tue Nov 25, 2014 12:22 pm

rhlhj wrote:I signed up for the service yesterday and logged in from a computer at work. Since then, I've received about 10 additional codes that did not seem to be initiated from a login attempt.

Has anyone else had this problem?

Early adopter woes - having to deal with all the bug fixes for a new system.

xenial · Post by **xenial** » Tue Nov 25, 2014 12:28 pm

1530jesup wrote:
toto238 wrote:
lululu wrote:Suck eggs, you people with no text capabilities, signed Vanguard.
You can use Google Voice with it. Or alternatively, join the 21st century and get a cell phone.
so this is not available for those of us still mired in 20th century cutting edge technology like a desktop PC? (With Windows 8.1).

It is indeed available. Sign up for a free Google Voice account. You get a "mobile" phone number with it, and you can elect to have text messages sent to your Gmail account.

KyleAAA · Post by **KyleAAA** » Tue Nov 25, 2014 5:34 pm

heartwood wrote:
KyleAAA wrote:
heartwood wrote: 4th: Funny, Vanguard says "When you set up this service, you choose whether you want to receive a security code every time you log on to vanguard.com or our mobile apps or only when we don't recognize the device that you're using." Yet I can use their mobile app without triggering the code requirement.
Do they have a separate configuration for the mobile app? Theoretically, 2 factor would be superflous for a mobile app since they can probably tie access to your specific device.
I don't know what you mean by "separate configuration." It's their app on an android phone. I launch the app, enter in my user name and PW, same as online in my laptop browser. I've activated code on the account, but the app doesn't ask for one. I also tried it for my account on my wife's phone in the app and it does not ask for a code their either. But take a look at the above Vanguard quote. They're saying it should be the same in "our mobile apps", not me.

I interpreted the Vanguard quote above as saying you can set it up to ask for a code in one, more than one, or none of the situations listed, hence the question. Since the 2nd factor is "something you have," it seems unnecessary to require a code since they already KNOW you have the specific device in your hand. Perhaps the only send the code if you install the app on yet another device Vanguard doesn't already recognize?

rhlhj · Post by **rhlhj** » Wed Nov 26, 2014 3:15 pm

rhlhj wrote:I signed up for the service yesterday and logged in from a computer at work. Since then, I've received about 10 additional codes that did not seem to be initiated from a login attempt.

Has anyone else had this problem?

I alerted Vanguard as suggested. They had not heard of this issue before.

I think I cracked the case, though. Every time i open up the Mint app, it tries to log in and sends me another code.

crg11 · Post by **crg11** » Wed Nov 26, 2014 10:29 pm

rhlhj wrote:I think I cracked the case, though. Every time i open up the Mint app, it tries to log in and sends me another code.

I can confirm that. Hopefully Mint fixes it soon, because it won't update my Vanguard data and I'm not turning off the login security code now we have it.

JVT · Post by **JVT** » Thu Nov 27, 2014 3:07 pm

I added my Google Voice number; however, I am getting texts both to my regular cell and Google Voice. My cell is attached to the account but I only wanted the texts to go to Google Voice since I dont have an unlimited plan and dont always have my cell handy when I want to log in. Hopefully the will get this fixed to only send to the number I typed in to register rather than all registered phones.

xenial · Post by **xenial** » Thu Nov 27, 2014 3:57 pm

JVT wrote:I added my Google Voice number; however, I am getting texts both to my regular cell and Google Voice. My cell is attached to the account but I only wanted the texts to go to Google Voice since I dont have an unlimited plan and dont always have my cell handy when I want to log in. Hopefully the will get this fixed to only send to the number I typed in to register rather than all registered phones.

Did you by any chance set up Google Voice to forward text messages automatically to your cell phone? If not, you might want to call Vanguard and tell them about the unwanted texts.

JVT · Post by **JVT** » Thu Nov 27, 2014 6:32 pm

Nope its not forwarding. I sent them a message about it last night.

ataloss · Post by **ataloss** » Fri Nov 28, 2014 10:24 am

Suck eggs, you people with no text capabilities, signed Vanguard.

If you turn on the computer specific restriction (as I have) the potential evil doer has to physically steal your computer as well as get your password. I think my risk of getting struck by a meteorite is higher. Still nice that Vanguard is making yet another form of security available to those who choose to use it.

semperlux · Post by **semperlux** » Fri Nov 28, 2014 6:18 pm

Thank-you for the heads up. Just enrolled. Been waiting for this feature for a long time.

xenial · Post by **xenial** » Thu Dec 04, 2014 11:01 pm

Vanguard is publicizing the security code feature now. I just logged into my account, and the following message was displayed prominently on the password page:

New logon security feature

This optional service allows you to receive a security code via text message. You'll use the security code in addition to your user name and password during logon. (This service may not be available to all clients.)

I'm already using the security codes, so the announcement was wasted in my case.

Jim180 · Post by **Jim180** » Thu Dec 04, 2014 11:18 pm

I follow Vanguard's low cost philosophy in other aspects of my life such as not having a cell phone. Just send me a token like Schwab does and I'd be happy.

vitaflo · Post by **vitaflo** » Thu Dec 04, 2014 11:43 pm

ataloss wrote:
Suck eggs, you people with no text capabilities, signed Vanguard.
If you turn on the computer specific restriction (as I have) the potential evil doer has to physically steal your computer as well as get your password. I think my risk of getting struck by a meteorite is higher. Still nice that Vanguard is making yet another form of security available to those who choose to use it.

What happens if your computer dies?

Phineas J. Whoopee · Post by **Phineas J. Whoopee** » Thu Dec 04, 2014 11:55 pm

vitaflo wrote:
ataloss wrote:
Suck eggs, you people with no text capabilities, signed Vanguard.
If you turn on the computer specific restriction (as I have) the potential evil doer has to physically steal your computer as well as get your password. I think my risk of getting struck by a meteorite is higher. Still nice that Vanguard is making yet another form of security available to those who choose to use it.
What happens if your computer dies?

Yup. That's a problem. Vanguard, like anybody else in the space, has to have a way of relying solely on what you know, or on physical documentation you can produce (which of course can be counterfeited if it's worth it to the crook to go to so much trouble), even if you've enabled voice recognition because the pattern could be changed by a smoke inhalation injury in the same event that toasted your computer, so you don't lose all access to your assets forever due to adverse circumstances like that.

It's still a lot better than just a password, though. At the very least you're making yourself a more difficult target. As I've written before, if the CIA or the FSS comes after me personally I'm toast. Other than that, although I'm against the practice of picking pockets, so long as I'm powerless to end it I may as well render myself a bad mark.

PJW

ataloss · Post by **ataloss** » Sat Dec 06, 2014 7:58 am

What happens if your computer dies?

Only a problem is you have the smoke inhalation voice change at the same time

astrohip · Post by **astrohip** » Sat Dec 06, 2014 9:10 am

It seems to me that Vanguard has offered a new feature, a better security process, for those who want to use it. And only for those who want to use it. With no requirement that everyone use it.

So for people who have been clamoring for a more secure login process, your wish has been granted.

And for those who don't want to use it, who don't have smartphones, or think their laptop is soon to be stolen, or whatever, you don't have to use it. And you are exactly where you were before. No better nor worse.

My point being, I'm not sure why there are so many complaints and negative posts in this thread. Vanguard has made a change that a small minority doesn't like, for what is probably valid reasons for that group. But any change will result in a small group of unhappy users. That doesn't mean Vanguard shouldn't move forward, and continue to move forward.

Now someone will post again and express why this change does them no good, or why they can't use it. And that's fine. But don't keep the rest of us from moving to a more secure experience.

ataloss · Post by **ataloss** » Sat Dec 06, 2014 9:50 am

True. People have their pet issue and want that implemented. I was a fan of the RSA security tokens over at E*trade but less so now that they (RSA) were hacked. Vanguard has good security. Probably user error/carelessness is the biggest risk but we all think that applies only to the other guy

JMacDonald · Post by **JMacDonald** » Sat Dec 06, 2014 10:11 am

I signed up last night. It works well, no problems.

blevine · Post by **blevine** » Sat Dec 06, 2014 10:54 am

My Flagship rep, whom I have never spoken to (only rare emails), left me a voicemail about my
email requests to have two factor authentication, making sure I was aware of this new feature
(which I was so yet again no benefit from Flagship yet).

This was not the solution I asked for exactly, my Etrade account uses the dynamically changing
password each and every time, which is less convenient, therefore seems more secure.
But this is an improvement and I think may be a good compromise.

letsgobobby · Post by **letsgobobby** » Sat Dec 06, 2014 11:04 am

ataloss wrote:
Suck eggs, you people with no text capabilities, signed Vanguard.
If you turn on the computer specific restriction (as I have) the potential evil doer has to physically steal your computer as well as get your password. I think my risk of getting struck by a meteorite is higher. Still nice that Vanguard is making yet another form of security available to those who choose to use it.

Unless you're stupid enough to store your password on your computer. But who would be that stupid (

looks in mirror)?

Bubbagump · Post by **Bubbagump** » Sat Dec 06, 2014 11:09 am

These threads always amaze me. A new feature is rolled out that didn't exist before that everyone happily lived without for 30 years.... Then everyone craps all over it. 2 factor auth is a fantastic addition in my mind and doing it via SMS is very cost effective. Consider the cost of messing with people's personal RSA keys, bingo cards or whatever other options were offered in the thread. What I found interesting is as soon as I turned on 2 factor auth, I started getting texts at 2AM. Yes, folks were actively trying to brute force my account. Luckily, the "known device" option (where you answer a security question and a cookie is laid down) is an option to further protect the account. I think this is a very good combination of cost effective security. Perhaps folks not terribly familiar with authentication would benefit from what we use as factors in the security community.

* What you know (passwords/phrases, security questions, combinations there of)
* What you have (RSA keys, bingo cards, a one time password sent to a separate device aka your cell, cookie on your machine)
* Who you are (finger prints, retinal scans, hand scans)

Biometrics are not feasible and Vanguard has doubled up on both of the others. I'd say that is quite reasonable.

letsgobobby · Post by **letsgobobby** » Sat Dec 06, 2014 11:48 am

I wish they didn't have the phone number restriction, but I won't say why because others have dumped on me before when I've disclosed it. Suffice to say, it would be more helpful to me if we could access, say, my wife's Vanguard account using my cell phone.

Sounds like Google Voice could help us get around that, but that means giving Google even more of my life's information than they already have.

theduke · Post by **theduke** » Sat Dec 06, 2014 12:49 pm

astrohip wrote:It seems to me that Vanguard has offered a new feature, a better security process, for those who want to use it. And only for those who want to use it. With no requirement that everyone use it.

So for people who have been clamoring for a more secure login process, your wish has been granted.

And for those who don't want to use it, who don't have smartphones, or think their laptop is soon to be stolen, or whatever, you don't have to use it. And you are exactly where you were before. No better nor worse.

My point being, I'm not sure why there are so many complaints and negative posts in this thread. Vanguard has made a change that a small minority doesn't like, for what is probably valid reasons for that group. But any change will result in a small group of unhappy users. That doesn't mean Vanguard shouldn't move forward, and continue to move forward.

Now someone will post again and express why this change does them no good, or why they can't use it. And that's fine. But don't keep the rest of us from moving to a more secure experience.

Very well said.

bru · Post by **bru** » Sat Dec 06, 2014 12:58 pm

Soon I will have unlimited texts but for now I pay for each. How would GV work with this? I'd have to check my GV account for the code? Seems a bit cumbersome.

I'm not comlaining per se since I really don't have too much concern regarding security, just wondering how someone with text service can best do this.

ataloss · Post by **ataloss** » Sat Dec 06, 2014 1:16 pm

This was not the solution I asked for exactly, my Etrade account uses the dynamically changing
password each and every time, which is less convenient, therefore seems more secure.

It seemed more secure until RSA was hacked. Back in the old days I assumed it was magic and not subject to hacking.

Soon I will have unlimited texts but for now I pay for each. How would GV work with this? I'd have to check my GV account for the code? Seems a bit cumbersome

.

Open Google voice in one broswer tab, open the login for Vanguard in another. Not too cumbersome. Of course I have 2 factor for my Google accounts using text.

What I found interesting is as soon as I turned on 2 factor auth, I started getting texts at 2AM. Yes, folks were actively trying to brute force my account.

How are they going to brute force your account with Vanguard's 3 strikes and the account is locked policy?

xenial · Post by **xenial** » Sat Dec 06, 2014 1:24 pm

ataloss wrote:
bru wrote:Soon I will have unlimited texts but for now I pay for each. How would GV work with this? I'd have to check my GV account for the code? Seems a bit cumbersome.
Open Google voice in one broswer tab, open the login for Vanguard in another. Not too cumbersome. Of course I have 2 factor for my Google accounts using text.

You can also set Google Voice to forward texts to your Gmail account.

Bubbagump · Post by **Bubbagump** » Sat Dec 06, 2014 1:45 pm

What I found interesting is as soon as I turned on 2 factor auth, I started getting texts at 2AM. Yes, folks were actively trying to brute force my account.

How are they going to brute force your account with Vanguard's 3 strikes and the account is locked policy?[/quote]

Short answer: very slowly
Long answer: I am an idiot and as another user pointed out, it was Mint.

ataloss · Post by **ataloss** » Sat Dec 06, 2014 7:24 pm

Ah, Mint. I like the site and trust it enough for my checking and credit card accounts but I don't give it access to investment accounts.

masterofinvesting · Post by **masterofinvesting** » Sun Dec 07, 2014 7:49 pm

Quick Question: Has anyone used this feature with Quicken desktop yet? I am planning to sign-up, but not if my Quicken access will be blocked.

Thanks.

AAA · Post by **AAA** » Sun Dec 07, 2014 8:36 pm

The terms and conditions Vanguard requires for using this feature include the paragraph below. What does this mean and under what circumstances might it be called into play?

You hereby agree to indemnify and hold harmless Vanguard and its affiliates, subsidiaries, directors, officers, employees, agents, licensors, and any third-party information providers and vendors upon demand from and against any and all claims, losses, expenses, demands or liabilities, including attorneys' fees and costs, demanded of or incurred by such Vanguard parties in connection with any claim by a third party (including any intellectual property claim) arising out of (i) your use of the Service, (ii) your violation of these Terms of Use or of any applicable law, or (ii) the infringement, misappropriation, or violation by you, or other individual using your mobile phone, password, computer, or other access device, of any intellectual property, privacy or other right of any person. You further agree that you will cooperate fully in the defense of any such claims. Vanguard reserves the right to assume the exclusive defense and control of any matter otherwise subject to indemnification by you, and you shall not in any event settle any such claim or matter without the written consent of Vanguard.

TimeRunner · Post by **TimeRunner** » Mon Dec 15, 2014 5:56 pm

masterofinvesting wrote:Quick Question: Has anyone used this feature with Quicken desktop yet? I am planning to sign-up, but not if my Quicken access will be blocked.

Thanks.

VG's response to my query was: "The security code enhancement will not have any effect on the ability to continue downloading your transaction history from Vanguard into Quicken or TurboTax software. Information downloaded is conducted through Open File Exchange, a.k.a . OFX. These servers are dedicated to the electronic exchange of financial data between financial institutions, businesses, and consumers. They are separate from the logon path which provides the security code enhancement. If you need further technical assistance, please call us at 888-353-0547. Our specialists are available Monday through Friday between the hours of 8 a.m. and 7 p.m., Eastern time."

69chevy · Post by **69chevy** » Fri Jan 23, 2015 1:03 pm

[Thread merged into here, see below (page 3). --admin LadyGeek]

Props to Vanguard adding additional security to their customers accounts. We can now enable 2 factor authentication with the option of having to type a code sent to your cell phone via text, each time upon login (best) or only when a login from an unknown location/computer.

An additional logon security feature

Now you can sign up to receive a security code to enter in addition to your user name and password when logging on to your account. When you sign up for this service, you can choose to use the security code every time you log on to your account or only when Vanguard doesn’t recognize your computer or device.

A few seconds after entering your user name on vanguard.com, you'll receive a text message with a security code on your registered phone. Simply enter that code in the designated box. It's as easy as that. Each security code can only be used once and will expire if you don’t enter it within 10 minutes.

This would be something I'd recommend everyone enable. https://personal.vanguard.com/

FrogPrince · Post by **FrogPrince** » Fri Jan 23, 2015 1:21 pm

What happens when you travel abroad and don't have the same phone number? Google has a donloadable set of codes you can carry with you. Does Vanguard offer something similar?

Trice · Post by **Trice** » Fri Jan 23, 2015 1:23 pm

FrogPrince wrote:What happens when you travel abroad and don't have the same phone number? Google has a donloadable set of codes you can carry with you. Does Vanguard offer something similar?

It doesn't appear to, at least from what I can tell when I signed up for it. But you can easily disable the feature should you need to.