Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager.
The new password had to be exactly 8 digits, to be entered manually by clicking on a randomly organized virtual keyboard (of 10 buttons, from 0 to 9), with some JS code preventing any copy-paste or the use of my password manager.
- How does that new password policy changes the overall security of my bank account ?
- Should I be worried that now my bank account is only protected by an 8-digit password, whereas standard security rules I know for years do advice for using a wide range of characters, and (way) more of them (typically, 12 characters mixing digits, lower, upper case and special characters) ?
- Since my bank is not the only one to switch to that security policy (I know at least 2 other banks doing so, one being out of my country), I start to think a security group listened by banks is the origin of that policy change. Where do I start to look to learn more about this sudden and seemingly global change of policy ?