Banks are interesting. All I've encountered have quite weak password requirements & they don't ever force you to change your password (although some think changing passwords regularly
isn't that important anyway). They do seem to like 2 factor authentication though, like sending a confirmation SMS to your phone. While I think that part of this is them just writing off a certain amount of fraud, I think it also shows what's actually cost-effective at preventing fraud. i.e. if someone enters their password into a keystroke logger, it doesn't matter how strong said password is, and that event is more likely that someone brute force guessing your password.
Personally, I use a password management program (like KeePass) with a long master passphrase to open the file, and I use 16+ random character passwords for any sites that allow it, because once I'm using a password management program there's no reason not to make them as complicated as possible. I think that having non-trivial
separate passwords for every site I use is very important, and worth the risk of having all my passwords in a file that potentially could be stolen & unencrypted. And there is no way on earth that I can memorise all the passwords that I need, especially for sites that I only need to login to occasionally.
