This 160-bit recommendation appears to only be in the HOTP RFC, not TOTP. Presumably that number is because a secret that's at least as long as the HMAC hash function is desirable. Since HOTP defines itself as only SHA1 160-bit made sense, but with SHA256/SHA512 supported for TOTP maybe we should phrase it something like: `is recommended to be as long as your hash function's output (e.g. 256-bit for SHA256)`?