My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters.
Are there any reasons they chose exactly 6?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Why are there not less than 6 digits?
The longer the code, the harder it is to guess. One could argue that 4 is already enough if you discard the code after a failed attempt, but why should you throw away a little bit more security?
Why are there not more than 6 digits?
I think that's not related to security but to usability. WhatsApp tries to read the verification SMS automatically, but there are cases where the user has to enter the code manually. For example if the SMS takes long to receive, the app won't wait for it, but prompt you to enter it when you finally receive it.
Therefore the verification code should be easy to remember. Miller's law states that the number of objects an average human can hold in working memory is 7 ± 2. Seven digits would be a logical choice, but it's much easier to remember 6 digits, especially if you're distracted by your environment while using your mobile phone.
It's a compromise.
I do not know exactly why they have chosen 6 digit verification code, but here are my thoughts on this.
I assume the verification of a device is based on the ability to receive text messages, and the purpose of the verification is to tie a phone number to an account.
Say that you would automate that process.
If there are an excessive amounts of verifications attempts and sms messages for one phone number, someone would definitely notice. So lets say you do not care about which phone number you are trying to pair your whatsapp account with, and will try against an arbitrary phone number.
If they use 4-digits verification code, it would on average only require 10.000 attempts to guess a correct one.
And for a 6-digits verification code, it would require 1.000.000 attempts on average.
Its a balance between security and obscurity. If it would be feasible to guess a verification code, people would try, and there would be a cost for whatsapp to send out all this verification text messages.
With only 10.000 attempts, you could spread these attempts out on several days or months and still be successful, and perhaps it would not be noticed that easily.
But for 1.000.000 attempts, it would definitely be much harder to pull off.
So the bottom line, the length of the code is a balance between security and usability.