1

I've noticed that many services and/or platforms now send 6 digit codes to verify user actions. Typically sent to an email. With these being 6 digits long & assuming that you get at least 3 tries to enter there's a 1 in 333,333 chance that a malicious user could correctly guess the digits.

Seems low to me. Is this enough security?

Improve this question
4
  • 1
    Yeah I was wondering the same thing, though the amount of possibilities is huge (it's still a third of a million)
    – CreaZyp154
    Aug 27, 2021 at 11:44
  • 1
    These digits come after you've authenticated, right? And you need to be authenticated to use the digits once you get them? You always need to ask "secure against what" when you start with "Is it secure?"
    – schroeder ♦
    Aug 27, 2021 at 12:09
  • 2
    Yes, if I am able to compromise 1,000,000 accounts and then randomly guess verification codes, I will on average compromise 3 accounts. That is a success chance of 0.0003%. For comparison, phishing has a roughly 5% chance to succeed, so it's more than 16,000 times more likely to succeed.
    – user163495
    Aug 27, 2021 at 12:34
  • If it were much longer, more users would turn off 2FA and be that much less secure overall. They could send a much more complex link to click via email. Additionally guessing codes still is harder than just exploiting a kid that works in a phone store to port that number to a new sim card so an attacker can get your texts. So yes, SMS/text verifications are much less secure than an authenticator app with a time based token, and services that allow use of your phone number for verification are not following NIST recommendations pages.nist.gov/800-63-3
    – DanO
    Aug 27, 2021 at 21:00

2 Answers 2

Reset to default
3

Verification digits secure against a compromised account being used to perform certain actions.

So, if a malicious person was able to compromise the account, they would also need to compromise the channel used to transmit the verification code.

Or guess the code.

Guessing the code is so unlikely that it provides sufficient verification. If there are attempts to guess, then other analysis starts to kick in to determine if the account is suspicious. So, it's not just that the code might be accepted, but all the metadata around the code entry can be used to prove that someone guessed the code.

So, yes, until this method is shown to be insecure, it is secure enough. Even a 4-digit code could be deemed "secure enough", depending on the complimentary controls.

Improve this answer
1

If the validity of the code is not limited in time, and the number of retries is unlimited, and the tries are really fast, then no, it is not really secure.

If the number of tries is limited to three, and the code is valid for 5 minutes, then it might be OK-ish.

But as always, what are you trying to protect. For access to subscription newspapers, this is sufficiently secure. With three retries, the chance that someone reads an article without paying for it is lower than 1 in 300 000. As a permanent access code to nucleair launch codes, without additional measures, it is probably not sufficient.

The places where I have seen this pin-code type of security, there was always some additional set of measures:

  • the previous mentioned retry limit
  • the time limit on validity
  • the fact that the code is sent to an already known e-mail address (If you did not request this code, please contact our helpdes

Et cetera.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .