5 ms·

Is this the same authentication platform that TreasuryDirect uses? edit - looks like no. On the one hand a single sign on to both would have been nice, OTOH Tr

Is this the same authentication platform that TreasuryDirect uses? edit - looks like no. On the one hand a single sign on to both would have been nice, OTOH TreasuryDirect's authentication system is a PITA.

tempnow987 5y ago
TD login is basically unusable in my view. I stopped using it simply because it was so painful.
Someone1234 5y ago
TreasuryDirect, the site that has case-insensitive passwords, disallows password managers, disallows the use of your actual keyboard to enter your password, and has this dumb on-screen keyboard with tiny keys that ultimately accomplishes nothing? Super trash. It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or browser's network stack) and intercept pre-encrypted HTTPS traffic. Hooking traffic rather than keystrokes is preferred because in order to resell that stolen data the data needs CONTEXT. A stream of keys is difficult to interpret into anything meaningful at scale, whereas "HTTPS POST Request to URI [xyz] with fields [X & Y] with values [J & W]" is very monetizable. What I am saying is TreasuryDirect's on-screen keyboard "security" stuff is complete nonsense, it has no technical merit at all. None. Worse still it also hurts users of accessible technologies, touch-screens, or users using password managers (essentially promoting password re-use, a common problem).
- xxpor 5y ago
  The TreasuryDirect site makes me want to give the authority to the USDS/18F to proactively come in and say we're taking over your public facing website infrastructure to any executive branch agency. There's no excuse for something to look and behave like it hasn't been touched since 1996.
  - Spooky23 5y ago
    It’s been touched since then. Back in those days, their “MFA” was a wallet card that you had the match up for a code. It was like the old copy protection schemes used for games like Sim City.
    - xxpor 5y ago
      That almost makes it worse!
- artful-hacker 5y ago
  Not that this should be necessary by any means but I usually right click the password input -> inspect element -> paste my password in the value from my password manager. The on screen keyboard is so ridiculous.
- ewoodrich 5y ago
  On top of everything you mentioned, TreasuryDirect also has an insanely aggravating issue where if you click a navigation button twice (e.g clicking next again reflexively before the next page has fully loaded), it displays an error about invalid navigation and forces you to login again and start from the beginning. Even something as simple as disabling navigation links/buttons after being clicked before the next page load would mostly solve this and save hours of frustration having to re-login through their god awful signin flow every time.
- YeBanKo 5y ago
  I am able to use Safari key chain to enter my password. Not sure about other password managers.

tempnow987 5y ago

TD login is basically unusable in my view. I stopped using it simply because it was so painful.

Someone1234 5y ago

TreasuryDirect, the site that has case-insensitive passwords, disallows password managers, disallows the use of your actual keyboard to enter your password, and has this dumb on-screen keyboard with tiny keys that ultimately accomplishes nothing? Super trash. It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or browser's network stack) and intercept pre-encrypted HTTPS traffic. Hooking traffic rather than keystrokes is preferred because in order to resell that stolen data the data needs CONTEXT. A stream of keys is difficult to interpret into anything meaningful at scale, whereas "HTTPS POST Request to URI [xyz] with fields [X & Y] with values [J & W]" is very monetizable. What I am saying is TreasuryDirect's on-screen keyboard "security" stuff is complete nonsense, it has no technical merit at all. None. Worse still it also hurts users of accessible technologies, touch-screens, or users using password managers (essentially promoting password re-use, a common problem).

xxpor 5y ago
The TreasuryDirect site makes me want to give the authority to the USDS/18F to proactively come in and say we're taking over your public facing website infrastructure to any executive branch agency. There's no excuse for something to look and behave like it hasn't been touched since 1996.
- Spooky23 5y ago
  It’s been touched since then. Back in those days, their “MFA” was a wallet card that you had the match up for a code. It was like the old copy protection schemes used for games like Sim City.
  - xxpor 5y ago
    That almost makes it worse!
artful-hacker 5y ago
Not that this should be necessary by any means but I usually right click the password input -> inspect element -> paste my password in the value from my password manager. The on screen keyboard is so ridiculous.
ewoodrich 5y ago
On top of everything you mentioned, TreasuryDirect also has an insanely aggravating issue where if you click a navigation button twice (e.g clicking next again reflexively before the next page has fully loaded), it displays an error about invalid navigation and forces you to login again and start from the beginning. Even something as simple as disabling navigation links/buttons after being clicked before the next page load would mostly solve this and save hours of frustration having to re-login through their god awful signin flow every time.
YeBanKo 5y ago
I am able to use Safari key chain to enter my password. Not sure about other password managers.