TreasuryDirect.gov should get a special callout for forcing you to use an on screen keyboard to click your password, with of course paste disabled.