TreasuryDirect, the site that has case-insensitive passwords, disallows password managers, disallows the use of your actual keyboard to enter your password, and has this dumb on-screen keyboard with tiny keys that ultimately accomplishes nothing? Super trash.

It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or browser's network stack) and intercept pre-encrypted HTTPS traffic.

Hooking traffic rather than keystrokes is preferred because in order to resell that stolen data the data needs CONTEXT. A stream of keys is difficult to interpret into anything meaningful at scale, whereas "HTTPS POST Request to URI [xyz] with fields [X & Y] with values [J & W]" is very monetizable.

What I am saying is TreasuryDirect's on-screen keyboard "security" stuff is complete nonsense, it has no technical merit at all. None. Worse still it also hurts users of accessible technologies, touch-screens, or users using password managers (essentially promoting password re-use, a common problem).

Not that this should be necessary by any means but I usually right click the password input -> inspect element -> paste my password in the value from my password manager. The on screen keyboard is so ridiculous.

On top of everything you mentioned, TreasuryDirect also has an insanely aggravating issue where if you click a navigation button twice (e.g clicking next again reflexively before the next page has fully loaded), it displays an error about invalid navigation and forces you to login again and start from the beginning.

Even something as simple as disabling navigation links/buttons after being clicked before the next page load would mostly solve this and save hours of frustration having to re-login through their god awful signin flow every time.

The TreasuryDirect site makes me want to give the authority to the USDS/18F to proactively come in and say we're taking over your public facing website infrastructure to any executive branch agency. There's no excuse for something to look and behave like it hasn't been touched since 1996.

It’s been touched since then. Back in those days, their “MFA” was a wallet card that you had the match up for a code. It was like the old copy protection schemes used for games like Sim City.

That almost makes it worse!

I am able to use Safari key chain to enter my password. Not sure about other password managers.

TD login is basically unusable in my view. I stopped using it simply because it was so painful.