Nice read! Specifically, under 10.1:

> Offer the option to display text during entry, as masked text entry is error-prone.

And under 10.2.1:

> Support copy and paste functionality in fields for entering memorized secrets, including passphrases.

(... snip ...)

> Allow at least 64 characters in length to support the use of passphrases. Encourage users to make memorized secrets as lengthy as they want, using any characters they like (including spaces), thus aiding memorization. Do not impose other composition rules (e.g. mixtures of different character types) on memorized secrets. Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise. (See Section 5.1.1 for additional information).

Taken to the extreme is the US Government's TreasuryDirect website, where individuals can buy savings bonds. Instead of allowing you to type your password, they render a "virtual keyboard" that you have to use your mouse to click the keys one by one.

Oh, and that password? Not case sensitive.

> Oh, and that password? Not case sensitive.

What, you expect them to make a case-sensitive version of NTFS just to store your password??

NTFS is case-sensitive.

They made a case-insensitive version of NTFS just to store your password

It is case-preserving, but not case-sensitive.

So, it will show you what was entered and make you think it’s case-sensitive, but then when you go to do the comparison, it actually ignores case.

The stupid thing is that MacOS was also case-preserving but not case-sensitive for a long time.

APFS still defaults to case-preserving:

    [nathell@macmini /tmp]$ echo first > A
    [nathell@macmini /tmp]$ echo second > a
    [nathell@macmini /tmp]$ cat A
    second

That's how Windows will behave but not actually how the underlying filesystem does.

I think it’s internally case sensitive and provides case insensitive APIs to users, right?

Right, win32 is insensitive

I heard that systems like this were designed when there was a point in time(this may just be erroneous and such a time never actually existed) where keyloggers were more common than RATs, so government websites would often have this requirement due to the higher probability of access from public computers(library, etc), since that was also a point in time when fewer people had their own at home.

Hard to believe it requires a mouse. The government (everyone really but especially the government) generally would need to follow basic ADA guidelines...

Yes, the authors of that document did an great public service in letting us point to an "official government standard".