Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know:
Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password?
From what I know, the challenge is hard-coded, so an attacker already has this. So the only secret is the response, which is 20bytes SHA1.
A normal 40 character password has 40*~7bits (stripping non printable / usable chars in ASCII) as usable secret. So it should be more secure as that results in a 280 bit secret versus 160bit SHA1.
Edit: Assuming both, the Yubikey and the normal Password secrets are created using true randomness. So we're not talking about the improvements over the typical "Password1234" passwords.
If I'm missing anything feel free to correct me.