As another user has stated, per PCI-compliance rules, this is perfectly acceptable.
I wanted to clarify a bit exactly why things are this way. First off, the first six digits of the card number constitutes the BIN, a number which is considered "well-known". This is a number assigned to the institution that issued your card, and all other cardholders who are members of that institution share the BIN. So showing the BIN doesn't give an attacker any information he can't get simply by looking at the BIN list. Since obscuring the BIN provides only a marginal (some would say "trivial") amount of security, why mask it? The cleartext BIN is routinely used in payment processing, and masking it would create a lot more headaches for a nearly-zero increase in security.
Displaying the last four is typically the best compromise between displaying too much information and not enough information to uniquely identify the card when used for reconciliation, etc. If you work with credit card numbers a lot, you occasionally run across two identical masked card numbers, but with a 1/10,000 probability it does happen.
These two things taken together, you still are probably going to come back to the point "you're giving a data thief ten of the numbers, which reduces his search space to 1 million, and the checksum, which reduces it to 100,000!"
You have a valid point, but what does that mean? It means that the thief now has a list of 99,999 bad credit card numbers and 1 good one, with no way to tell which is the right one. The credit card number does not inherently carry any information that lets you know when you have the "right" number. It's not like solving a cryptographic puzzle; you must present the card for a payment to know if it's "good" or not. That means, to crack even ONE card, you have to compromise a merchant's payment platform and run an average of 50,000 transactions to find it. Considering merchants are charged per-transaction, it's greatly in their interest to ensure that someone can't do this sort of thing. And even if the merchant was a slouch in protecting his merchant account's credentials, payment processors often detect this sort of thing and shut the account off within seconds.