Google, MSN, Facebook, Twitter - They all already allow
you to use anything you want for your password.
This is not strictly true - while Google et al might have a large set of permitted characters, there are nearly always restrictions on length. Google, for example, requires that their passwords be at least 8 characters long. While a long password does reduce brute-force attacks and shoulder-surfing, it nevertheless is a restriction.
Requiring long passwords is a restriction that leads to a more secure password. This site (it's called weakpasswords) is about restrictions that make your password less secure.
The site for my credit card requires a password that is no more than 6 characters -- talk about insecure.
The site for my credit card requires a password that is no more than 6 characters -- talk about insecure.
Not necessarily. Oftentimes banks will set a hard limit on the number of unsuccessful attempts you can make before they lock you out entirely. Then you have to phone them and jump through a number of hoops to prove you are who you say you are, and then reset the password. If they do a really good job preventing brute-forcing, then having an un-brute-forceable password is not necessary any more.
The easiest example of this is debit card PINs. They are usually only 4 numeric digits, and yet are trusted by banks for direct access to accounts. This is because a) banks have sophisticated systems to track brute-forcing and other kinds of abuse, b) longer pins are more prone to being written down, forgotten, and mistyped, and c) there are limits on how much you can purchase / take out per day, limiting the potential damage.
So you're saying that having more chars in the password or more number options in the PIN wouldn't increase security?
PIN requires you to possess a card with the account details and relevant security data. Yes they're clonable but you can't do a distributed attack on thousands of accounts that way.
Online, as many banks have leaked customer data, one can use a botnet to try common passwords against thousands of customer accounts (you may need to get account data elsewhere to do this or customer numbers may be guessable). 6 chars severely limits the passwords to try.
