They might be attempting to prevent automated attacks, but there are many other ways to prevent those, for example, exponential back-off and disable after many attempts.
The banks and brokerage firms own websites allow use of password managers and pasted passwords. Why should TT be more restrictive?
If they claim it's for security purposes, it's fake security.
Clearly the low level CS people are not empowered to respond to customers concerns about this.
Meanwhile, there's the autohorkey workaround.
