Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit card?
Isn't it a risk for security using a short non-random password like that?
You're not comparing apples to apples in your comparison of password strength to your bank PIN.
Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a longer password with seemingly random patterns to prevent password guessing and brute force attacks etc.
Your bank card is based off what is known as two-factor authentication - something you have (your bank card) and something you know (your PIN). This extra element of having something you have (which, as you recall you don't have in the first scenario) arguably drastically increases the security when the item you have is handled with great care. With that in mind, you can usually get away with having a 4 digit code because the likelihood that someone will guess your PIN after randomly finding your card without alerting your financial institution is quite low.
It should go without saying that two-factor authentication is not without its flaws (someone could copy your magnetic strip on a non-chip'ed card and steal your PIN), however its additional security benefits allow you to have shorter password lengths without increasing the risk to the holder.
Originally it's to do with the difficulty of a brute force attack on the password.
Most websites are concerned about the possibility that some attacker might get hold of a file containing everyone's hashed passwords, and conduct an offline brute force attack using that. A properly set up attacker might be able to make millions of guesses per second (exact rate depending on whether the passwords are hashed using a suitable algorithm, and just how much silicon the attacker can bring to bear on the problem). So even 8 characters arguably is not sufficient.
Banks (for various reasons to do with their different security models) don't think they're likely to lose files containing PINs or their hashes without noticing, or anyway they're no more concerned than they are with losing millions in any other form of bank robbery. If you want to make a brute force attack on someone's PIN then (leaving aside home Chip and PIN readers), you have to put their card in an ATM or other device connected to the banking system, and type in a number. It's slow, and the machine eats the card after 3 wrong guesses.
Some websites use a similar lock-out to prevent online password-guessing attacks, but the main concern driving the need for password strength is the loss of password hashes. The main concern driving the (lack of) need for PIN strength is use of the physical card (or a clone of it, when using magnetic stripe technology).
Note that there is a still a non-trivial flaw in the simple version of the model I've described. If you steal 10,000 credit cards and make 3 guesses at each 4 digit PIN then you'll expect to get 3 right. Naturally though, a single ATM will notice that something is amiss if it has to eat 100 cards in a row, so I suspect/hope the cops would be on their way before then. Guessing card PINs is risky for the attacker.
In general, banks also pay closer attention to suspect card transactions than websites do to suspect logins. Some websites will try to notice and take extra security steps if they notice a login from a suspect location, adding extra security behind the password. But all card payment systems try to do this. Not that they always succeed.
I don't know what effect home Chip and PIN readers have on this. I just used mine to confirm that my PIN is correct, without any communication to the bank. It might be as simple as the Chip being smart enough to lock itself down after sufficient incorrect guesses. This would still be subject to the 10,000 stolen cards attack. You'd burn 99.97% of the chips, but those could still be used for card not present fraud and the other 0.03% would be good for fraud requiring the PIN. Naturally I'm not about to test that theory with my own card ;-)
Attackers with the ability to steal physical cards on that scale probably aren't messing about guessing PINs anyway. It's simply not the most efficient way to extract money from stolen or cloned cards.
In short, yes there is some risk in using short passwords that they might be guessed. But compared to websites guessing is much harder for attackers, banks defend in depth against card fraud, and they also have higher costs associated with someone forgetting a PIN than websites do with passwords. So they choose a different trade-off.
It's worth noting that part of this comes from the fact that DOS by bogus log-in is not a risk. If, for example, this website had a similar total (rather than perhaps blocking one IP only) lock-out after a set number of attempts then one could be a nuisance by making attempts to guess the password for different users (whether targeted or just hitting all the users from the published list), until they get locked out. This could in fact be more of a problem than successfully guessing a password; such an attack could render the site useless, while successfully breaking a password would allow for more limited vandalism that would have to be subtle (which takes effort) or else would soon be blocked by moderation.
With an ATM or chip-and-PIN card, the difference in what is protected makes lock-out more useful, while the necessity of having the card itself (or a clone of it) means that someone can only maliciously lock us out if they have the card, in which case we have lost part of our security and want to be locked out.
The requirements for passwords which contain digits, symbols and mixtures of upper-and-lower case letters are predicated on the idea that the attacker has a copy of the hashed password. Since the attacker has a copy of the hashed password, the attacker can run millions and millions of guesses against it, based on probing innumerable dictionary entries, plus variations, such as adding small integers prefixes and suffixes to every word, substituting 0 for O and so on. The attacker controls this cracking software, which will not lock him out after five failed attempts.
PINS are predicated on the idea that the storage which holds the PIN is secure in some sense. That in itself doesn't justify a mere four digit pin: another factor is that you possess the card which goes with the PIN. You cannot obtain cash from a bank machine if all you have is a user ID and PIN, but no card. If you have the card, but not the PIN, so that you're reduced to guessing, you will be locked out after a number of unsuccessful re-tries. Note that online banking, which doesn't require your card (only your card number) does not use your PIN for logging in.
Regarding the first point again, in fact is not a reasonable assumption that the attacker has a copy of the hashed password. Or, rather, that assumption is not acceptable to me, the end user. When a site makes us choose some obtusely difficult password, they are in fact telling us: "we are not making any effort to safe-guard your personal information from attackers --- such as your password hash". The problem with this is that unless I'm re-using the same password for multiple service providers (poor security practice), the password is probably the least important piece of personal information. Ideally, it contains no personal information at all, in fact. If an attacker has access to my hashed password, it means that the attacker has access to my entire user record, and that's the problem, not the password.
Ironically, many systems with this type of policy severely restrict the password length, and reject some characters such as spaces, so that users are denied the reasonable alternative of being able to use a long password phrase, which is easier to remember and type. This shows that the people who are implementing this password check do not really understand the issues, and are more concerned about being held blameless by copying whatever everyone else is doing.
EC Cards (very used in Germany) require 6 digits, compared to the 4 usually required for ViSA and MasterCard. So of course it is a bit more secure, dividing by 100 the chance to find your PIN code by pure chance, 3 wrong attempts meaning blocking the card of course.
