I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons".
The policy for new passwords is: 6 to 10 characters, no special characters, no repeated characters, not case-sensitive.
My old password was much better than this. I used a random password generator.
I am not a security expert but this seems like a lax policy. Am I being overly paranoid? This is a business account.
Should I suspect that I myself was hacked?
Note: The ATM card number is not part of the bank's online authentication process.
Note2: I went to Password Meter and was able to cobble together some passwords that meet this criteria and that Password Meter deemed "Very strong". Am I wrong to still be concerned?