4 ms·

> developed a ten year plan to fix their legacy problem then They did. And Pi factor came in. And budget was cut because those pesky fintech are a threat, and

> developed a ten year plan to fix their legacy problem then They did. And Pi factor came in. And budget was cut because those pesky fintech are a threat, and clearly money was better spent on a more modern offer than on those "security" concerns. And yes, it's possible to add 2FA to the front layer. However, the remnants of COBOL code running on the mainframe for the last 25 years weren't designed to handle passwords length 9 or more, and the last guy who knew how that code was built has retired some 15 years ago.

marcus_holmes 7y ago
That COBOL layer that underlies almost all of our infrastructure. It was written when the cost/benefit calculation of writing it involved "downsizing" thousands of clerks who were doing the job manually. It can't be replaced because the cost/benefit calculation of replacing it does not involve anything like those kinds of numbers. The benefits of avoiding even a major security incident just don't compare to the costs. Y2K taught me this. Nothing has changed since.
- dx034 7y ago
  Some banks are replacing their core banking system with new software. It's extremely expensive, a huge risk (any delay in migration means time where customers can't use ATMs or cards) and the benefit vs just adding API layers on top isn't always clear. At some point everyone needs to modernize but there are very few people who'd want to take responsibility for a project that size. TSB customers have learned how painful it can be if the migration of a core banking system fails: https://www.independent.co.uk/news/business/news/tsb-it-failure-cost-compensation-customers-switch-current-account-a8757821.html https://www.independent.co.uk/news/business/news/tsb-it-fail...
  - marcus_holmes 7y ago
    Not only banks. I bought a house with the money I made on a Y2K project for a water authority's billing system. I doubt they've managed to work out how to replace that mess of COBOL without going broke.
jdc 7y ago
[...] clearly money was better spent on a more modern offer than on those "security" concerns. And there's the real problem: The banks will save their money and stick with plaintext if they can get away it. Put another way, it's an incentive problem.
- moviuro 7y ago
  Have you seen how French banks authenticate users? With a six-digit PIN. See - https://www.labanquepostale.fr/ https://www.labanquepostale.fr/ > "Me Connecter" - https://lcl.fr/ https://lcl.fr/ > "Mon Espace" - https://particuliers.societegenerale.fr/com/icd-web/cbo/index.html https://particuliers.societegenerale.fr/com/icd-web/cbo/inde... > 12345678 > Valider
  - imtringued 7y ago
    Speaking about Germany here, the online banking userid is much longer and basically acts a second password. It's not written on your card or used for anything except logging into your account via online banking.

marcus_holmes 7y ago

That COBOL layer that underlies almost all of our infrastructure. It was written when the cost/benefit calculation of writing it involved "downsizing" thousands of clerks who were doing the job manually. It can't be replaced because the cost/benefit calculation of replacing it does not involve anything like those kinds of numbers. The benefits of avoiding even a major security incident just don't compare to the costs. Y2K taught me this. Nothing has changed since.

dx034 7y ago
Some banks are replacing their core banking system with new software. It's extremely expensive, a huge risk (any delay in migration means time where customers can't use ATMs or cards) and the benefit vs just adding API layers on top isn't always clear. At some point everyone needs to modernize but there are very few people who'd want to take responsibility for a project that size. TSB customers have learned how painful it can be if the migration of a core banking system fails: https://www.independent.co.uk/news/business/news/tsb-it-failure-cost-compensation-customers-switch-current-account-a8757821.html https://www.independent.co.uk/news/business/news/tsb-it-fail...
- marcus_holmes 7y ago
  Not only banks. I bought a house with the money I made on a Y2K project for a water authority's billing system. I doubt they've managed to work out how to replace that mess of COBOL without going broke.

jdc 7y ago

[...] clearly money was better spent on a more modern offer than on those "security" concerns. And there's the real problem: The banks will save their money and stick with plaintext if they can get away it. Put another way, it's an incentive problem.

moviuro 7y ago
Have you seen how French banks authenticate users? With a six-digit PIN. See - https://www.labanquepostale.fr/ https://www.labanquepostale.fr/ > "Me Connecter" - https://lcl.fr/ https://lcl.fr/ > "Mon Espace" - https://particuliers.societegenerale.fr/com/icd-web/cbo/index.html https://particuliers.societegenerale.fr/com/icd-web/cbo/inde... > 12345678 > Valider
- imtringued 7y ago
  Speaking about Germany here, the online banking userid is much longer and basically acts a second password. It's not written on your card or used for anything except logging into your account via online banking.