3 ms·
> Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. Is that really secure? I mean,
by orf 9y ago
> Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric.
Is that really secure? I mean, 6 numbers is not exactly a very strong secret.
- Terribledactyl 9y agoIt's fine if you can invalidate the secret after some finite number of tries and block a particular actor from attacking many accounts. And there's no leaking cross sites if someone obtains and breaks the salted hash db.
- jlgaddis 9y agoIt is for something like a CAC PIN.