Comment by dgrin91 | Hacker News Reader

Comment by dgrin91 | Hacker News Reader

I decided to go in and buy some I-Bonds for the first time. To do this you need to make an account with https://www.treasurydirect.gov/. My god this was a shockingly bad experience filled with security theater.

* Passwords must be at least 8 chars, but can't be longer than 16 (they don't tell you the max length though

* Passwords can't have \

* Passwords are case-insensitive

* When you actually try to log in they make you use a virtual keyboard - meaning you have to use your MOUSE to click each individual character which is shown on screen in plain text. The keyboard does not work on purpose, and password manager don't work either.

From their security FAQ - > Virtual Keyboard: The virtual keyboard is one of many security features introduced in TreasuryDirect as part of our on-going commitment to heightened password and account security. The advantage of using the virtual keyboard is that others are deterred from learning your password.

It reminds me of that video from a while back of UX designed by the devil. I know its government, but what an awful experience.

Yeah it's pretty bad.

To enter password via keyboard/paste: right click password element -> inspect -> remove the `readonly="readonly"` attribute.

I was surprised today, Safari autofilled the password for me. First time I tried using it with Safari.

It’s astonishingly bad. I right clicked the input and put my password in via the browser console. Much easier.

Also, better not forget your security questions twice, or you’re going to be on the phone with an absolutely atrocious hold experience.

I am sure HNians put those security questions and answers in their password manager too.

I've started doing that now but when I created my TreasuryDirect account 9 years ago I wasn't doing that yet. I hope I never have to call.

When I called in to reset my password last year, they read the answers to my security questions back to me…

Last time I saw virtual keyboard as a security feature, it was in an early 2000s Korean MMO filled with bots...

Dublin bike hire does it, including shuffling the numbers. I could almost understand it at the terminals at bike hire points, but they do the same on their web interface.

Of course the real insecurity is they assign you a fixed numeric 6 digit PIN.

re virtual keyboards: thwarts physical keyloggers. it thwarts kernel keyloggers too, but if you have a kernel keylogger kernel mitm is also a possibility (minus bandwidth costs.) eons ago I had an hsbc card with random digits sent to me. the hsbc login asked for a random subset of the digits on the card + password which would thwart short-lived mitms — thinking back, that was pretty clever

Sounds like what Canada Revenue Agency has up now as well, their 2FA setup gives you a 5x5 grid of random 3-letter combos, and when logging in they'll ask you for a specific three of them.

Honestly it's a PITA (I need to keep said PDF vaguely handy, and it's stored less securely than in my password manager).

I found that it works to right-click the password field input, inspect and edit the html element, and paste my password from my password manager into the "value" property before submitting.

It's still annoying, but I think it beats using their virtual keyboard.

Yup, that or remove readonly="readonly" from the password input.

Created this bookmark:

  javascript:(function(){document.querySelector(".pwordinput").removeAttribute("readonly")})();

I have tried three browsers to get an irs.gov login and none works completely, there’s a failure on one step or another and they are using some third party login service.

Are you using ad blockers, tracking protection or enhanced browser security? Consider using a stock Google Chrome installation from a desktop computer.

I’m not defending the “good enough for government” mentality but merely suggesting some workarounds (FWIW it works on my computer.)

Yeah, when I first registered I was amazed in a bad way about the website.

Then I kind of wanted to learn the history of how this was created for a guaranteed head-shaker.

I don't get why it's so bad. I've had to use the UK government website system for my residence visa and it was a breeze. The US department of the treasury gets $22 billion to spend every year on administration.

That's $220 billion per decade. Surely they can shell out a crazy $5 million every ten years for a usable site refresh?

The site looks like Sharepoint. I didn’t bother to check that it is, though. If it is, $5 mil is not enough to put a nice UI on that pig.

Welcome to the United States. The dysfunction is real. We spend lots of money on dumb stuff, but we can’t agree on where to spend it better.

It’s bad because i bonds aren’t a garbage product people need to be sold on.

It crashed Chrome right after I hit "submit" on the purchase. Nice!

After logging in again and seeing $0.00 everywhere, I found a transaction list showing that a purchase request went through. Hopefully the amounts will update tomorrow!

Takes a day - it will update.

It's now going to update at the speed of the ACH transfer from your bank, maybe as soon as tomorrow. Then you'll see two transactions: the requested date, and the date of the receipt of funds from your bank.

I actually gave up because the registration failed on me multiple times, citing they're not able to verify my identity

They're still using security image!! (which to this date I still don't know what it does)

If its the same implementation I am familiar with, its to proffer something unique to the user that they are familiar with that a phisher would likely not have, though of course, they could make a request to the provider as you as soon as you offer your username lol.

They told me the same thing, and then I added my driver's license number and it let me through...

... and then they sent me an email saying my account needs additional verification. They want me to fill out https://www.treasurydirect.gov/pdf/rs/acctauth.pdf - which somehow doesn't load in the browser, but works with wget - which would require me to sign it in the presence of a "certifying officer".

Yeah, jumping through all these hoops isn't worth even 10% interest on $10k.

Wait how do they implement case insensitive passwords? Do they to_lower() it on the client?

By forcing you to type using an onscreen virtual keyboard.

Possibilities

1. They store your plaintext password and then compare to_upper() of your stored password against what you enter on the virtual keyboard (which only supports uppercase letters).

2. They to_upper() your initial password, before they salt/hash, and test the salted hash against the salted hash of whatever you type on the virtual keyboard

3. Either one of the above but with an additional to_upper() on the password you enter at login so that if you do manage to type the password using your keyboard instead of the virtual keyboard it's still case insensitive.

Could be worse. They used to ship you an individual physical decoder card.

It is so bad. So, so bad.

Reply on news.ycombinator.com