https://github.com/LimeSurvey/LimeSurvey/pull/4559

Decision needed

1. Set 128 (or more) witjout any way to update
2. Add a php config settings to allow setting to more than 128

I would prefer (2) to add this as config option in the plugin with a default of 160 (as they have in RobThree/TwoFactorAuth).
But I did not find the time to add the option myself, yet.

But I did not find the time to add the option myself, yet.

OK i take it.

And maybe like that

    $secretlength = intval($this->get('secretlength', null, null, 0));
    if ($secretlength < 128) {
        $secretlength = 128;
    }
    $oTFAModel->secretKey = $o2FA->createSecret($secretlength);

Unless there is a possibility, however slim, that there is an advantage in bidding less than 128.

I see no reason to use less then 128 bit.
Smaller values create smaller qr codes but still no one should use less.