The Connection Sequence
When you navigate to the TD Business Central login page, your browser initiates a TLS 1.3 handshake with TD's web servers. That handshake establishes an encrypted tunnel before a single byte of credential data leaves your machine. The server presents a certificate issued by a recognized Canadian certificate authority. Your browser verifies the certificate chain automatically — if anything looks wrong (expired cert, domain mismatch, untrusted issuer), the browser blocks the connection entirely.
Once the encrypted tunnel is established, the login page loads. No credentials are cached client-side. Password fields use secure input handling that prevents clipboard snooping and keystroke logging from basic malware. The MFA code exchange happens server-side, with the one-time token validated against TD's authentication service before the session begins.