> Maybe that challenge question is just a long password (recovery key). Specifically, recovery keys are designed to be so long and complex that no human could

> Maybe that challenge question is just a long password (recovery key). Specifically, recovery keys are designed to be so long and complex that no human could possibly memorize them, ensuring that they’re written down / printed instead of memorized — thus making them a “something you have” credential rather than a “something you know” credential.