3 ms·

I remember at least one major US bank saying that the reason they only allowed short passwords was indeed that it was the limit for login passwords on their mai

by tzs 1y ago

I remember at least one major US bank saying that the reason they only allowed short passwords was indeed that it was the limit for login passwords on their mainframe. I was sure this was complete bullshit because even if everything is handled on the mainframe a user using their online banking would not be logging on to the mainframe. The online banking password is a credential for the bank's application(s) that run on top of the mainframe's system software. When a new customer signed up for an account the bank would not create a new mainframe user account for that user. A bank customer account would just exist in the bank's database and would be completely independent of actual mainframe user accounts. If the online banking password needed to be stored on the mainframe it would be in one of the bank's tables, not wherever that mainframe's system software stores password. I mentioned this somewhere and someone who actually worked on bank systems commented that some banks actually really do have a mainframe user account per bank customer account. I think that doesn't actually change my point that blaming a short online banking password limit on mainframe system software limitations is complete bullshit. Users are not asked for their password when they use non-online banking, such as at ATMs or through a teller at the bank. This shows that the bank does have interfaces that allow performing all the normal functions a customer needs to do without the customer needing to supply a login password. Online banking is going through a web server. They web application should be using those interfaces that don't require a customer mainframe login to work. The password the customer supplies to the web interface should be a credential for the web interface and be completely separate from any mainframe login password.

SoftTalker 1y ago
The pathways and decisions made might be unintuitive and effects can linger even after the original reasons no longer apply. Where I work, usernames are still limited to 8 characters because some old unix platforms didn't support more than that. I'm virtually certain that none of those are still in use today, but the requirement was baked into user provisioning in ways that would be expensive to change, so they keep with it.
mindslight 1y ago
My hunch is that the idea that some banks have a mainframe user account per bank customer is a red herring, and that the real answer is that the customers are indeed in a separate database table. But that database is a mainframe database, and the field is a fixed width that maybe could be changed but the mainframe admins see no reason to.

by tzs 1y ago

SoftTalker 1y ago

The pathways and decisions made might be unintuitive and effects can linger even after the original reasons no longer apply. Where I work, usernames are still limited to 8 characters because some old unix platforms didn't support more than that. I'm virtually certain that none of those are still in use today, but the requirement was baked into user provisioning in ways that would be expensive to change, so they keep with it.

mindslight 1y ago

My hunch is that the idea that some banks have a mainframe user account per bank customer is a red herring, and that the real answer is that the customers are indeed in a separate database table. But that database is a mainframe database, and the field is a fixed width that maybe could be changed but the mainframe admins see no reason to.