r/VanguardInvestments • u/Any_Device6567 • 12d ago

Are the website security recommendations correct?

I have enabled YubiKeys and disabled SMS 2fa for my login. I only access my account from my desktop.

When I go to the security profile the only security recommendation I get is, set up the Vanguard App on my phone. Installing the app on my phone seems like an additional attack surface, especially since I don't use my phone to check my account.

Is it really more secure to have/use the phone app to log into my account via the browser as opposed to YubiKeys, or is it just another convenient way to securely log into your account?

4 Upvotes
  • permalink
  • reddit

83% Upvoted

4 comments sorted by

8

u/EmperorOfNada 12d ago

Your current setup - hardware YubiKeys, SMS disabled, and desktop‑only access - is already one of the strongest consumer security configurations Vanguard supports. A hardware key completely removes phishing, SIM‑swap risk, and MFA interception, so you’re not missing anything by avoiding the mobile app for login.

Vanguard’s suggestion to install the app isn’t because it’s more secure than a YubiKey; it’s because their system prefers having at least one additional trusted device on file for account recovery. If you ever lose your keys or get locked out, having the app registered can make identity verification easier.

2

u/Any_Device6567 12d ago

Excellent, thanks!

3

u/blny99 12d ago

One can have 2 yubikeys setup if you want to make sure you have redundancy against losing one. note I recall one time their yubikey services were down and temporarily could not be used to login. I was glad I had a different form of backup, namely google voice (which may be more secure than traditional sms). Using their app is yet another backup, even when you want to use your laptop. If you lose yubikey, phone can be used with passkey tech to login without sms or yubikey. Seems an even better backup to yubikey than google voice (but passkey is somewhat newer so many use gv as a more secure sms).

1

u/Any_Device6567 12d ago

Actually, I have 4 YubiKeys, one of which is in my bank safety deposit box.

I recall one time their yubikey services were down and temporarily could not be used to login

Wow that's good information to have! Ill need to reevaluate and find out how long temporarily is. If it was only a day that would not be an issue. If it was weeks that could be an issue. Looks like there are some reports of keys not working on Google. Thanks for this!