# How does Amazon secure its 6 digit one-time password?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few retries (requesting OTP resend)?

It seems that they put a captcha ahead of this and probably have some timeout where the OTP expires or unspecified limit when too many attempts will lock the account from further retries. But nevertheless this doesn't seem like a very good idea to me. I think Google Apps uses 8 characters with multiple character sets (lowercase, uppercase, numeric, symbol), which seems like how I would implement something like this.

What are good best practices for implementing a similar password reset mechanism with 6 digit numeric PIN on my own web app? Or is this a bad idea?

• As long as the timeout,captcha and only allowing a few attempts are not bypassed.This seems fine Jul 1, 2020 at 6:33
• @mentallurg - no, if you pull off 3 retries over 3 resets of OTP, it approximates to 1e-5: 3e-6+3e-6*(1-3e-6)+... Jul 1, 2020 at 8:47
• In your case we have 2 digits so we're down to 1e4 :) Jul 1, 2020 at 10:32
• 3 retries over 3 resets is still only 9 guesses, so the odds of success are `9/1e6 = 9e-06`. You could approximate that as `1e-5` (aka 1 in 1e5), however you don't explain in your question that you get the 1e5 by assuming 3 guesses for 3 retries. If you just guess once then @mentallurg is 100% correct: your odds of success are 1 in 10^6, not 1 in 10^5. Jul 1, 2020 at 10:35
• My original wording (still unchanged) read: 1 in 10^5~ chance of being accessed through brute force guess factoring in a few retries (requesting OTP resend). I don't know the retry parameters of Amazon's web app, it could be 20 retries before we get locked out for all I know. I explicitly used the tilde sign to show the approximation, and I explicitly emphasized this was factoring in the retries. I really appreciate that you both are spending the time writing these replies, and I'm happy to edit my question if provided a better alternative, otherwise I feel we're being pedantic here. Jul 1, 2020 at 17:39