> Ultimately, it's not some malicious intent or incompetence, but simply the acknowledgement that the legacy systems will not enjoy PBKDF hash+salt+iterations columns being added 30 years after the fact.
Are banks running their web interface on 30+ year old legacy systems? I'd expect the web stuff to be on much more modern systems, which call upon the 30+ year old stuff to do the underlying financial stuff.
Maybe, that COBOL codebase doesn't contain the web-facing stuff. It's not handling user auth and all of that. It doesn't seem to make much sense for the web-facing side to be so directly connected to the financial backend, anyway, because some kinda privilege escalation or crafted input exploit on the web side could give someone direct access to the financial backend. Those two things are likely pretty heavily separated.
So instead, it seems like the stuff holding just account holder information was given a password field to use on their fancy new HTML 2.0 webpage, but then just mostly left there ever since. The age of the financial side is fairly irrelevant in this scenario.
Are banks running their web interface on 30+ year old legacy systems? I'd expect the web stuff to be on much more modern systems, which call upon the 30+ year old stuff to do the underlying financial stuff.