My bank (Westpac) only allows 6 alphanumeric characters in their passwords.

Westpac's interface is quite funny. Only very recently did they allow pasting passwords from a password manager, previously you had to use an on screen keyboard (presumably to stop keyloggers).

On that note; any recommendations for Aussie banks that have a secure and modern interface?

Westpac customer here. If you just need basic banking, you can’t beat ING. They still have a dumb type-a-PIN-by-pressing-buttons login screen, and the customer ID field doesn’t accept pasted data, but other than that I love them. No fees, even on international transactions. Apple Pay if you want it.

I'd love to endorse ING, but i must say, their security really worries me. I'm just putting this out there: you log in to internet banking with your "customer number" which is printed on your bank card, and then you have exactly 4-digit PIN you key in with their stupid on-screen keypad.

I love that they're relatively modern for Australian standards (fast payments, no fees ever, basically) so i'd love to endorse them, but i, too, am on the lookout for a replacement bank that has e.g. MFA with TOTP or a physical challenge-response box like my otherwise overpriced ABN bank account gave me back in 2002, in the Netherlands...

So i, too, am all ears for recommendations.

EDIT: and once you're in internet banking, you can willy nilly transfer cash out if you either use a "saved address" (someone you've paid before) or you'd need to hijack my mobile number. But $deity knows that's easy - just claim you own a number and get it ported over to a new service no-questions-asked. Facepalm, really.

I've found Bankwest to be pretty solid from a tech standpoint.

Lots of their app functionality is now handled through AWS from what i've heard.

And that same bank doesn't distinguish between upper and lower case characters in the password either.

That usually means they are on some kind of ancient mainframe.

Wouldn't a workaround for this be storing the (smaller) hash of a better passphrase, and using that to authenticate once arrive at the "vital bits"?

Then again...someone complacent enough to get that far behind in infrastructure probably doesn't have any chance of that being thought of/appoved.

> Then again...someone complacent enough to get that far behind in infrastructure probably doesn't have any chance of that being thought of/appoved.

I see you've worked in the enterprise? :-)

Another reason is that nobody knows how it really works. The people who knew have long retired. The fear is updating it will likely introduce subtly new behavior and new bugs that everyone is scared of touching it.

I believe Air France still does 4 digit pins :(

At least the KLM funnel into the same backend forced you to switch to a password a few months back.