8 characters are easily enough, alphanumeric, that’s 32^8 = 1099511627776
You can’t brute force that without getting noticed.

But still the guy obviously has no idea what he’s taking about, but security is probably not his job.

ataferner:

I wish that I could use a stronger password for this site. 8 characters are NOT enough.

Response (Gaurav Sharma) 02/06/2010 05:53 AM

Thank you for your email regarding your online password.

I would like to inform you that our website has a 128 bit encryption. With this base, passwords that comprise only of letters and alphabets create an algorithm that is difficult to crack. We discourage the use of special characters because hacking softwares can recognize them very easily.

The length of the password is limited to 8 characters to reduce keyboard contact. Some softwares can decipher a password based on the information of “most common keys pressed”.

Therefore, lesser keys punched in a given frame of time lessen the possibility of the password being cracked.

Moreover, American Express is committed to protecting the privacy and security of all of our Cardmembers, both on-line and off-line. We believe that our current security measures, which include our sophisticated monitoring systems to detect unusual or fraudulent card activity, provide strong, ongoing protections for our Cardmembers.

Rest assured, I have forwarded your comments to our webmaster for review. During this review, we may contact you if additional information is required.

We value your membership and wish goodness and health to you and your family.

Sincerely,
Gaurav Sharma
Email Servicing Team
American Express Interactive Services

O_o