Skip to main content
ravron
April 27, 2022
Question

TreasuryDirect password cannot autofill

  • April 27, 2022
  • 19 replies
  • 1177 views

TreasuryDirect is a US government service that lets users purchase US bonds from the Treasury directly (hence the name). It's... old school, shall we say. This is the login page, but unfortunately you cannot get to the password page without entering a valid account number. I've attached a screenshot of the password entry page.

The intention, presumably to stymie keyloggers, is that the user clicks the keys on the virtual keyboard to enter their password. Obviously, this is slow and rather error-prone, especially with a long, complex password generated by 1Password. (Side note: the password is not case sensitive, which is a little scary) Unfortunately, 1Password in the browser cannot autofill the password. I experimented a bit with tweaking the page's HTML, and the issue seems to be that the input has the attribute readonly="readonly". When I delete that attribute, 1Password can fill the field correctly.

Are there any existing solutions to allow 1Password to fill this password? Right now, I hack at the HTML manually each time I log in, though I might investigate getting a browser extension that can do this for me. Interestingly, there are a couple previous threads about this, but they're ancient.

19 replies

MrC
April 28, 2022

I can safely say that the last time I was on that site, was the last time I was on that site. It is dreadfully bad.

I found no workaround for the pop-up keyboard. In the end, I just threw away my login entry, and my wife and I had a nice laugh.

ravron
ravronAuthor
April 28, 2022

Yeah, it's definitely not going to win any design awards. But as far as I know it's the only way to buy certain savings bonds, so I'm stuck with it.

kevin_li
1Password Employee
April 28, 2022

Hi @ravron,

It is indeed an issue we are aware of. I appreciate you sharing the workaround of deleting the readonly="readonly" attribute. I will share it with our development team to investigate further. Thank you so much.

ref: dev/core/core#12067
ref: dev/core/core#191

May 2, 2022

I think that 1Password had a work around for this before on the Mac 7.x version. It recently stopped working. I also had some javascript in a bookmark to change the readonly attribute, but that stopped working recently as well. There is some javascript that currently works to remove the attribute that can be found on the internet that you can put into a bookmark, but I am waiting for a 1Password solution to make this work again that I personally don't have to maintain for my 1Password family!

May 6, 2022

Hey @bh444 - Thanks for sharing those sweet little hacks to make life a bit easier on this lovely site. I'm hopeful our team will be able to assess a possible solution for a future update to 1Password. Thanks for your support! 🙂

May 7, 2022

Hey @Paul.m_1p - I put in an email support QGX-25992-922 to see if I could get this functionally restored. Could you get it passed on to the level of support where javascript is understood. It can be closed, but I'd like to get this on the 1password roadmap if possible.

1Password Employee
May 7, 2022

Thanks @bh444. I've found your support request, we'll continue to work with you there! 😊

ref: QGX-25992-922

May 8, 2022

@ag_chantelle @paul.m_1p

I am not really thrilled that 1Password forces bug reporters to send in a JSON file gathered from the non-working login page. This JSON file contains personal information including my username, and my (worthless) personal image caption. I edited the file before sending it in to remove my personal information. You had enough data to fix this bug, and have in fact have fixed it at least once in 2016, seemingly without collecting a username. See https://1password.community/discussion/comment/332958

You should be able to fix a bug or add a feature without collecting personal user information that should remain private. A less sophisticated user would have sent you their username in this file. If a well intentioned developer used my username in their bug fixing activity, my account could easily be locked or disabled when unsuccessful login activity was detected from potentially anywhere in the world as a result of testing a bug fix.

I don't think I'll be using your email reporting system again.

May 28, 2022

Hi @bh444! Thanks for raising your concerns here, and I'm sorry that this information was initially included. Collecting the page details tells us what the extension sees when deciding what can be filled, so it helps us find what the problem is. This allows us to work with more information to create a fix for a website.

We don't use your username when troubleshooting, and redacting this information was the right thing to do here. I'll share your feedback on this with the rest of the team to see if we can improve things in the future.

Baz
October 19, 2022

I'm looking forward to a solution. Has any progress been made or is there some estimate of when there will be support for that site?