In pursuit of "better security" all browsers are asking for at least 8 letters/digits (most want a mix that can easily go past 8 letters/digits/symbols) and some are asking for questions/answers as well.    Most of them record your ISP and if you come in from somewhere else they choke it all down unless you verify yourself out the wazoo.

It is the way of the future.   Google, upon your request, can actually sub in a finger print sensor if you have one of their more modern phones with the sensor.

Yes, I do remember the old original 4 digit "ID codes"  rather fondly ....   but they are long long long gone.

Here is the danger, there are phishing schemes out there afoot to get you to re-enter your stuff so the phishing site has it now, then they can rob you at whim later.

Rule of thumb -- ignore it, if it is for real you will get LOTS of chances to respond to it later on.