As I rotate passwords, I am reminded that treasurydirect has the worstest password experience. ever. a virtual keyboard? ignore case? phantom password length limits? Who did this? #infosec