Hacker News Reader

Per RFC (for HOTP, which is just TOTP w/o the time element)...

"The HOTP value must be at least a 6-digit value. It is also desirable that the HOTP value be 'numeric only' so that it can be easily entered on restricted devices such as phones."

6 was defaulted to in the TOTP for being 'secure enough' and easy enough for most people to remember.

Exactly, it’s a pragmatic choice.

There are scenarios where that doesn’t provide sufficient assurance, but those scenarios are also not really suited for TOTP in the first place!

Why should the codes be longer? Is your concern brute force attacks on the code across a network connection on something that is attempt limited?

it's kind of interesting that physical totp generators like entrust, securid, etc all went with 8 digits vs the "typical" digital totp codes being 6 digits long

I'm not so much concerned with brute force as that 8 is better than 6

Not necessary _longer_ but could include letters too.