Hacker News Reader

> Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric.

Is that really secure? I mean, 6 numbers is not exactly a very strong secret.

View on HN

It's fine if you can invalidate the secret after some finite number of tries and block a particular actor from attacking many accounts. And there's no leaking cross sites if someone obtains and breaks the salted hash db.

It is for something like a CAC PIN.

Reply on news.ycombinator.com