"Memorized secrets that are randomly chosen by the CSP (e.g., at enrollment) or by the verifier (e.g., when a user requests a new PIN) SHALL be at least 6 chara

"Memorized secrets that are randomly chosen by the CSP (e.g., at enrollment) or by the verifier (e.g., when a user requests a new PIN) SHALL be at least 6 characters..." Does this include credit/debit card PINs? "Verifiers also SHALL NOT prompt subscribers to use specific types of information (e.g., “What was the name of your first pet?”) when choosing memorized secrets." I take it this proscription applies to the actual passphrase, not as part of an account reset mechanism? If so, that's too bad, I really don't like these questions let alone the storage of the answer. Are these answers secrets though? If so, send like it's proscribed, and also they have to be salted and hashed in which case the answer itself isn't being stored.