Comment by orf

> Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric.

Is that really secure? I mean, 6 numbers is not exactly a very strong secret.