[timeal]

This story needs to be upvoted 1000 times. Why are financial institution so _bad_ at password policies?

[feld]

Probably mainframes that they can't get rid of, or systems emulating / used to working with them.

[colinbartlett]

I presume they "can't" because it's too expensive?

How expensive is too expensive for some of the richest companies in the world?

[nkantar]

When it costs more than the perceived value of benefits.

"Acceptable risk" is the usual term, I believe.

[einhverfr]

> Why are financial institution so _bad_ at password policies?

Legacy code written quickly in 1998 and not replaced yet?