6

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters.

Are there any reasons they chose exactly 6?

1

2 Answers 2

8

Why are there not less than 6 digits?

The longer the code, the harder it is to guess. One could argue that 4 is already enough if you discard the code after a failed attempt, but why should you throw away a little bit more security?

Why are there not more than 6 digits?

I think that's not related to security but to usability. WhatsApp tries to read the verification SMS automatically, but there are cases where the user has to enter the code manually. For example if the SMS takes long to receive, the app won't wait for it, but prompt you to enter it when you finally receive it.

Therefore the verification code should be easy to remember. Miller's law states that the number of objects an average human can hold in working memory is 7 ± 2. Seven digits would be a logical choice, but it's much easier to remember 6 digits, especially if you're distracted by your environment while using your mobile phone.

Conclusion

It's a compromise.

7

I do not know exactly why they have chosen 6 digit verification code, but here are my thoughts on this.

I assume the verification of a device is based on the ability to receive text messages, and the purpose of the verification is to tie a phone number to an account.

Say that you would automate that process.

If there are an excessive amounts of verifications attempts and sms messages for one phone number, someone would definitely notice. So lets say you do not care about which phone number you are trying to pair your whatsapp account with, and will try against an arbitrary phone number.

If they use 4-digits verification code, it would on average only require 10.000 attempts to guess a correct one.

And for a 6-digits verification code, it would require 1.000.000 attempts on average.

Its a balance between security and obscurity. If it would be feasible to guess a verification code, people would try, and there would be a cost for whatsapp to send out all this verification text messages.

With only 10.000 attempts, you could spread these attempts out on several days or months and still be successful, and perhaps it would not be noticed that easily.

But for 1.000.000 attempts, it would definitely be much harder to pull off.

So the bottom line, the length of the code is a balance between security and usability.

9
  • 5
    Your "on average" figures are wrong. They are worst case figures. You would be exceedingly unlucky if it took exactly 1 million attempts to guess a 6 digit code. Jun 11, 2016 at 18:43
  • 2
    @MartinSmith You are assuming they repeatedly have to attempt guessing the same code, hence previous guesses could be ruled out. However that sounds like an unlikely assumption. You don't get to try thousands of times guessing the same verification code. At some point you'll have to try guessing a new 6 digit code, possibly after each attempt. In that case the average number of attempts to succeed does in fact become one million.
    – kasperd
    Jun 11, 2016 at 18:46
  • @kasperd - You're right, that is what I was thinking. I'm still not sure the maths is right though. A random guess for a newly issued number has a 99.9999% chance of being wrong. But 0.999999 ^ 693147 is where it drops below 50% so wouldn't 693,147 be the expected attempts? Jun 11, 2016 at 19:01
  • 1
    @kasperd How is that the average?
    – Random832
    Jun 11, 2016 at 19:39
  • 1
    @kasperd I get that. I don't understand how you can possibly think that the average sequence length is one million.
    – Random832
    Jun 11, 2016 at 20:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.