Hacker News Reader

Comment by moviuro | Hacker News Reader

> developed a ten year plan to fix their legacy problem then

They did. And Pi factor came in. And budget was cut because those pesky fintech are a threat, and clearly money was better spent on a more modern offer than on those "security" concerns.

And yes, it's possible to add 2FA to the front layer. However, the remnants of COBOL code running on the mainframe for the last 25 years weren't designed to handle passwords length 9 or more, and the last guy who knew how that code was built has retired some 15 years ago.

View on HN

That COBOL layer that underlies almost all of our infrastructure.

It was written when the cost/benefit calculation of writing it involved "downsizing" thousands of clerks who were doing the job manually.

It can't be replaced because the cost/benefit calculation of replacing it does not involve anything like those kinds of numbers. The benefits of avoiding even a major security incident just don't compare to the costs.

Y2K taught me this. Nothing has changed since.

Some banks are replacing their core banking system with new software. It's extremely expensive, a huge risk (any delay in migration means time where customers can't use ATMs or cards) and the benefit vs just adding API layers on top isn't always clear. At some point everyone needs to modernize but there are very few people who'd want to take responsibility for a project that size.

TSB customers have learned how painful it can be if the migration of a core banking system fails: https://www.independent.co.uk/news/business/news/tsb-it-fail...

Not only banks. I bought a house with the money I made on a Y2K project for a water authority's billing system. I doubt they've managed to work out how to replace that mess of COBOL without going broke.

[...] clearly money was better spent on a more modern offer than on those "security" concerns.

And there's the real problem:

The banks will save their money and stick with plaintext if they can get away it.

Put another way, it's an incentive problem.

Have you seen how French banks authenticate users?

With a six-digit PIN.

See

- https://www.labanquepostale.fr/ > "Me Connecter"

- https://lcl.fr/ > "Mon Espace"

- https://particuliers.societegenerale.fr/com/icd-web/cbo/inde... > 12345678 > Valider

Speaking about Germany here, the online banking userid is much longer and basically acts a second password. It's not written on your card or used for anything except logging into your account via online banking.

Reply on news.ycombinator.com