My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in is forced to be 6 digits long, numerical.
This goes a long way against what I thought to be a secure password policy. On the other hand, I trust my bank to know what they are doing.
Could you help me understand how good this policy is?
- Compared to common practices in the sector.
- From a more general IT security point of view.
- As a customer: How much should I be worried that my account may be easy to compromise?
- The user is id card number, which is almost public data.
- Someone entering my account is still not able to make a payment before it goes through another security mechanism (which we will assume to be good).