AMEX password policy - "a daily WTF"

This, as my good buddy Russ points out - belongs on the daily WTF. I was registering my account on the AMEX (American Express) site and came across this mind-boggling "feature". Apparently, AMEX has a policy, as follows, for their login and password that I would whole-heartedly disagree with. To be fair, there are many schools of thought that would dictate that password policy is irrelevant on a website, and that security shouldn't be based on password strength alone - but I don't necessarily think that this means that you should forgo logic on password policy either.

With that being said - here's a lovely screen-shot, complete with auto-pop-up from AmericanExpress.com.

I would absolutely LOVE to hear the community's feedback to this. Am I nuts to think this is a little low on the security totem?

User ID Policy:

• 5-20 characters
• At least one letter (not case sensitive)
• No spaces or special characters (&, >, *, $, @)

Password Policy:

• 6 to 8 characters
• At least one letter and one number (not case sensitive)
• No spaces or special characters (&, >, *, $, @)
• Different than UserID

Hey - wait a minute, what about PCI Compliance you ask? Well, the PCI DSS says the following about password(s) and password strength:

• 8.5.10 Require a minimum password length of at least seven characters

• 8.5.11 Use passwords containing both numeric and alphabetic characters

While technically, AmEx conforms to the PCI Standards I would argue their "compliance" is half-hearted (letter of the law, rather than the spirit). PCI DSS says your password has to be at least 7 characters long - but what if it's no more than 8 characters long? So... wow - way to go American Express. Leading the way in security and customer protection once again.

Proof positive folks, compliance does not equal security. Just because you're "PCI Compliant" doesn't mean you even begin to comprehend security policy creation and security strategy in general. Obviously...

Yikes. Shame on AmEx.