TreasuryDirect, the site that has case-insensitive passwords, disallows password managers, disallows the use of your actual keyboard to enter your password, and has this dumb on-screen keyboard with tiny keys that ultimately accomplishes nothing? Super trash.
It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or browser's network stack) and intercept pre-encrypted HTTPS traffic.
Hooking traffic rather than keystrokes is preferred because in order to resell that stolen data the data needs CONTEXT. A stream of keys is difficult to interpret into anything meaningful at scale, whereas "HTTPS POST Request to URI [xyz] with fields [X & Y] with values [J & W]" is very monetizable.
What I am saying is TreasuryDirect's on-screen keyboard "security" stuff is complete nonsense, it has no technical merit at all. None. Worse still it also hurts users of accessible technologies, touch-screens, or users using password managers (essentially promoting password re-use, a common problem).
It still amuses me how few people, even those who claim security expertise, don't understand that commercial malware is able to hook the driver stack (and or browser's network stack) and intercept pre-encrypted HTTPS traffic.
Hooking traffic rather than keystrokes is preferred because in order to resell that stolen data the data needs CONTEXT. A stream of keys is difficult to interpret into anything meaningful at scale, whereas "HTTPS POST Request to URI [xyz] with fields [X & Y] with values [J & W]" is very monetizable.
What I am saying is TreasuryDirect's on-screen keyboard "security" stuff is complete nonsense, it has no technical merit at all. None. Worse still it also hurts users of accessible technologies, touch-screens, or users using password managers (essentially promoting password re-use, a common problem).