Hacker News Reader

This story needs to be upvoted 1000 times. Why are financial institution so _bad_ at password policies?

Probably mainframes that they can't get rid of, or systems emulating / used to working with them.

I presume they "can't" because it's too expensive?

How expensive is too expensive for some of the richest companies in the world?

When it costs more than the perceived value of benefits.

"Acceptable risk" is the usual term, I believe.

> Why are financial institution so _bad_ at password policies?

Legacy code written quickly in 1998 and not replaced yet?