4 ms·

What protocols and software stacks do they use? How are they networked? What are the steps in the verification process? What prevents it from being able to work

by jrcii 11y ago

What protocols and software stacks do they use? How are they networked? What are the steps in the verification process? What prevents it from being able to work in real time? Where is this type of information formally recorded? I had a hard time turning it up. For such a critical and prolific infrastructure it's unusually opaque.

PeterisP 11y ago
> What protocols and software stacks do they use? Heterogenous, differs between institutions, differs within institutions, also many/most institutions are a mix of incompatible systems because the business institutions are a merger of mergers with acquisitions of mergers, all while requiring to keep constant operations, full archives of all past deals of all those legacy institutions and compatibility. In some spaces, Java is popular, in some spaces COBOL is used, and many have something from a multitude of different exotic niche platforms. In any case you'd expect to have a mix of systems/platforms, some of them modern, some of them older than you are. You'd have 'common' platforms/stacks e.g. oracle on linux, or mssql on windows, you might encounter something also running on LAMP somewhere, and you might have e.g. a custom platform with integrated DB-like and programming-like functionality running on a particular version of AIX, all of those in a single institution. > How are they networked? All kinds of things. Some use common TLS channels. Some parts of business may even use simple file transfer or public email without expecting the channel to provide any security, but rely on each separate message being securely encrypted and signed. For anyone that you "don't know personally", there's SWIFT that will give you secure though not cheap messaging - if you get a swift message from e.g. FBNINGLA then you can be sure that yes, this actually is an authorised representative of the First Bank of Nigeria. > What are the steps in the verification process? Depends on your pre-existing relationship - if you trust them up to some limit (equivalent to a credit line up to that limit), then you do technical verification that the request is authorised and authentic and that's it. If you don't, you wait until they somehow hand over the 'cover funds' to someplace that you securely control, verify that it is received there (e.g. account statement from that place at the end of their business day), and then proceed further. > What prevents it from being able to work in real time? I believe mainly because multiple independent parts of the process that have no motivation to change, and often have motivation to not change - if you agree to do your part of the things faster and cheaper, it adds cost and decreases fee revenue; and changing things requires cooperation and investment from a majority of players. Up to some part, there may be legal obstacles that prevent some particular ways to be done faster (the liability 'hot potato' issues) but IMHO those would be quickly solved by the industry, lobbyists and involved lawmakers if the motivation was there. > Where is this type of information formally recorded? It's heterogenous, so it's a multitude of similar-and-different things. For any particular payment system you'll have short public descriptions and also available training courses, technical standards, etc though often at a significant fee. It is niche expertise required within that niche, and not particularly PR-useful to publicize in detail, probably entirely the other way around.
rconti 11y ago
I once worked with an ACH system where the transactions were in a txt file on a Windows box that was, IIRC, copied over ZMODEM after a dialup modem connection was opened to whatever the other party was (bank? processor? I don't know). Obviously, given the liability involved, I never messed around with it. But I always wondered what would happen if some amount was different than expected. One would hope there's all kinds of verification going on, but I kind of doubt it. This was only 10 years ago.
- otakucode 11y ago
  When I worked at a data center for a bank, we had basically the exact setup you are describing. Part of my responsibilities was to take note of the amount that came through via ACH on that Windows machine (Windows 3.11 actually... this was in 2001) and enter it into a Lotus 1-2-3 spreadsheet, along with totals which I got from reports that ran after the days batch processing completed, and make sure they balanced. If they didn't balance, I had to go hunting and pray that I simply transposed a number or typoed something along the way... if I did not, I honestly don't know what happened. I had to call one of the other employees to come in and orchestrate getting it fixed. (I was alone at the data center, which consisted of a mainframe and a handful of PCs... probably an order of magnitude smaller than what you would picture if I just say 'data center') Luckily, it happened very very rarely. Maybe a handful of times in the 4 years I worked there.

by jrcii 11y ago

PeterisP 11y ago

> What protocols and software stacks do they use? Heterogenous, differs between institutions, differs within institutions, also many/most institutions are a mix of incompatible systems because the business institutions are a merger of mergers with acquisitions of mergers, all while requiring to keep constant operations, full archives of all past deals of all those legacy institutions and compatibility. In some spaces, Java is popular, in some spaces COBOL is used, and many have something from a multitude of different exotic niche platforms. In any case you'd expect to have a mix of systems/platforms, some of them modern, some of them older than you are. You'd have 'common' platforms/stacks e.g. oracle on linux, or mssql on windows, you might encounter something also running on LAMP somewhere, and you might have e.g. a custom platform with integrated DB-like and programming-like functionality running on a particular version of AIX, all of those in a single institution. > How are they networked? All kinds of things. Some use common TLS channels. Some parts of business may even use simple file transfer or public email without expecting the channel to provide any security, but rely on each separate message being securely encrypted and signed. For anyone that you "don't know personally", there's SWIFT that will give you secure though not cheap messaging - if you get a swift message from e.g. FBNINGLA then you can be sure that yes, this actually is an authorised representative of the First Bank of Nigeria. > What are the steps in the verification process? Depends on your pre-existing relationship - if you trust them up to some limit (equivalent to a credit line up to that limit), then you do technical verification that the request is authorised and authentic and that's it. If you don't, you wait until they somehow hand over the 'cover funds' to someplace that you securely control, verify that it is received there (e.g. account statement from that place at the end of their business day), and then proceed further. > What prevents it from being able to work in real time? I believe mainly because multiple independent parts of the process that have no motivation to change, and often have motivation to not change - if you agree to do your part of the things faster and cheaper, it adds cost and decreases fee revenue; and changing things requires cooperation and investment from a majority of players. Up to some part, there may be legal obstacles that prevent some particular ways to be done faster (the liability 'hot potato' issues) but IMHO those would be quickly solved by the industry, lobbyists and involved lawmakers if the motivation was there. > Where is this type of information formally recorded? It's heterogenous, so it's a multitude of similar-and-different things. For any particular payment system you'll have short public descriptions and also available training courses, technical standards, etc though often at a significant fee. It is niche expertise required within that niche, and not particularly PR-useful to publicize in detail, probably entirely the other way around.

rconti 11y ago

I once worked with an ACH system where the transactions were in a txt file on a Windows box that was, IIRC, copied over ZMODEM after a dialup modem connection was opened to whatever the other party was (bank? processor? I don't know). Obviously, given the liability involved, I never messed around with it. But I always wondered what would happen if some amount was different than expected. One would hope there's all kinds of verification going on, but I kind of doubt it. This was only 10 years ago.

otakucode 11y ago
When I worked at a data center for a bank, we had basically the exact setup you are describing. Part of my responsibilities was to take note of the amount that came through via ACH on that Windows machine (Windows 3.11 actually... this was in 2001) and enter it into a Lotus 1-2-3 spreadsheet, along with totals which I got from reports that ran after the days batch processing completed, and make sure they balanced. If they didn't balance, I had to go hunting and pray that I simply transposed a number or typoed something along the way... if I did not, I honestly don't know what happened. I had to call one of the other employees to come in and orchestrate getting it fixed. (I was alone at the data center, which consisted of a mainframe and a handful of PCs... probably an order of magnitude smaller than what you would picture if I just say 'data center') Luckily, it happened very very rarely. Maybe a handful of times in the 4 years I worked there.