12 ms·

This wasn’t the authors fault at all. It’s 2022, not 1998. I would expect a banking/payment UI to be very clear and foolproof.

FireBeyond 4y ago
I am not sure how much clearer "Your deposit exceeded the limit. The excess funds will be returned" could be.
- mindslight 4y ago
  You have not quoted the email correctly. The email says "excess purchase". As someone who has experience with savings bonds and Treasury Direct, I still have no clue how to interpret that phrase. Savings bonds are discrete things with discrete values, even though TD has worked to smooth over that quality with arbitrary purchase amounts and partial redemptions. "Excess purchase" may very well mean a refund of the entire singular $9,975 bond that was purchased. The way to find out is to call TD or search around web forums, but it's understandable that OP reacted to one possible implication of the message rather than taking a few hours to find out what it means.
  - zerocrates 4y ago
    They are probably getting a full refund of both the $10,000 and the $9,975 purchases. Eventually. It's possible they'll get $25 and $9,975 back and end up with $10,000 in bonds total, though I'd doubt it. The website not stopping or warning you is one thing, though I think the real change needed here is on the backend: when executing the order it should check your limit before trying to transfer the money. The way they're doing it is probably safer for them in terms of races or whatever, and who knows what ancient Treasury system it's probably interfacing with, but still.
- deleted 4y ago
  [deleted]
- coffeeblack 4y ago
  You should never get to that point. Why would they take the money when they know that it is an invalid transaction?
ceeplusplus 4y ago
Hah, if you've ever used the TreasuryDirect site it's a disaster from the Windows XP days. Reminds me of those old Flash and Silverlight apps. The keyboard in the article is a virtual keyboard you click to type your password in for "security" reasons (yet there's no 2FA app supported).
- kube-system 4y ago
  It made sense at one point in the past when everyone was worried about keyloggers and nobody was thinking about credential stuffing. Information security has come a long way in the past 20 years.

FireBeyond 4y ago

I am not sure how much clearer "Your deposit exceeded the limit. The excess funds will be returned" could be.

mindslight 4y ago
You have not quoted the email correctly. The email says "excess purchase". As someone who has experience with savings bonds and Treasury Direct, I still have no clue how to interpret that phrase. Savings bonds are discrete things with discrete values, even though TD has worked to smooth over that quality with arbitrary purchase amounts and partial redemptions. "Excess purchase" may very well mean a refund of the entire singular $9,975 bond that was purchased. The way to find out is to call TD or search around web forums, but it's understandable that OP reacted to one possible implication of the message rather than taking a few hours to find out what it means.
- zerocrates 4y ago
  They are probably getting a full refund of both the $10,000 and the $9,975 purchases. Eventually. It's possible they'll get $25 and $9,975 back and end up with $10,000 in bonds total, though I'd doubt it. The website not stopping or warning you is one thing, though I think the real change needed here is on the backend: when executing the order it should check your limit before trying to transfer the money. The way they're doing it is probably safer for them in terms of races or whatever, and who knows what ancient Treasury system it's probably interfacing with, but still.
deleted 4y ago
[deleted]
coffeeblack 4y ago
You should never get to that point. Why would they take the money when they know that it is an invalid transaction?

ceeplusplus 4y ago

Hah, if you've ever used the TreasuryDirect site it's a disaster from the Windows XP days. Reminds me of those old Flash and Silverlight apps. The keyboard in the article is a virtual keyboard you click to type your password in for "security" reasons (yet there's no 2FA app supported).

kube-system 4y ago
It made sense at one point in the past when everyone was worried about keyloggers and nobody was thinking about credential stuffing. Information security has come a long way in the past 20 years.