4 ms·
Per RFC (for HOTP, which is just TOTP w/o the time element)... "The HOTP value must be at least a 6-digit value. It is also desirable that the HOTP value b
by quaffapint 5y ago
Per RFC (for HOTP, which is just TOTP w/o the time element)...
"The HOTP value must be at least a 6-digit value. It is also
desirable that the HOTP value be 'numeric only' so that it can be
easily entered on restricted devices such as phones."
6 was defaulted to in the TOTP for being 'secure enough' and easy enough for most people to remember.
- Spooky23 5y agoExactly, it’s a pragmatic choice. There are scenarios where that doesn’t provide sufficient assurance, but those scenarios are also not really suited for TOTP in the first place!