Windows XP and IE6 have been out of support for quite a while. They've long been dropped in favor of windows 7 (LTS support until 2023) and 10 more recently, which comes with internet explorer 10 or 11.
SSL would be quite easier to keep up-to-date if Microsoft actually upgraded their operating system and applications to support TLS 1.2 by default, which they don't for retro compatibility reasons.
For reference, working at JP Morgan, I can tell you that the company has dropped support for Internet Explorer entirely. Half of the existing internal apps don't even load on IE. Would be nice of vendors to stop wasting their time praising IE support as a feature.
Windows 8.1 has support until 2023. Windows 7 support is over since January 14, 2020. https://support.microsoft.com/en-au/help/13853/windows-lifec...
TOTP (RFC 6238) or HOTP (RFC 4226) are less secure than photoTAN/chipTAN because they are phishable, as in you can think you authorize a 30€ transfer for an internet purchase while in reality it's a 30000€ transfer to some bad people. photoTAN/chipTAN on the other hand are challenge-response based and send data about the transaction to the second factor device so that you can verify it before confirming.
Actually, this statement is not true, as those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2]. Attackers or malicious activities on Android can easily modify the payload and still have a valid transaction for the end-user; showing up the wrong IBAN, wrong amount and wrong recipient. This applies to both the official banking apps and the photoTAN generator devices that Cronto is (re-)selling.
Note that the research was made public and reposted/printed in a _lot_ of newspapers in 2016. And of course, nothing got improved.
If you search the web for Uni Erlangen (FAU) and the "crypto" analysis, you'll find out that Cronto / CrontoSign is the software supplier for pretty much every major bank.
And yes, it's patented, and yes, other frameworks got taken down on GitHub for copyright infringements when they tried to reverse engineer it.
The only open implementation of the HBCI 2.2 / FinTS 3 [3] standard that I personally know of that hasn't been taken down already is libfintx [4].
[1] (German) https://www.fau.de/2016/10/header/phototan-banking-nicht-sic...
[2] https://faui1-files.cs.fau.de/filepool/projects/matrix-code/...
Your linked sources [1] and [2] don't really cover that topic. They mainly cover the use of Android apps and highlight the danger that the Android devices might be hacked, recommending use of dedicated devices. From [2]:
> Last but not least, please note that the photoTAN procedure is not only available as a smartphone app but also as dedicated hardware (Cronto, 2011). Naturally, our statements about the security features of app-based authentication cannot be transferred to thephotoTAN hardware device. Quite the contrary, a dedicated photoTAN device — available for all three analyzed banks — offers excellent security properties largely similar to those of chipTAN.
But this wasn't your point. It might very well be that the transaction data is not verified by the generator devices and only displayed, but your sources don't state it.
From trying to roll their own crypto, to still using legacy ssl to support ie6...everything is shitty.
Even when they are forced by law [1] to integrate modern 2FA, they find ways to implement it in a shitty, proprietary way.
PSD2 is required since September 2019 and every single bank rolled it out in August and waited until the very last moment.
I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]?
[1] https://ec.europa.eu/info/law/payment-services-psd-2-directi...
[2] https://tools.ietf.org/html/
[3] https://tools.ietf.org/html/rfc6238