2

In most phone applications with two factor authentication I noticed that the verification code is usually 6 digits long.

I wonder why 6 digits are needed - we already know that the user is associated to a specific phone number. Why can't we use 4 digits code?

Is there a problem that two different users (with two different phone numbers) will get the same generated 4 digits code? if this is a problem, obviously 6 digits code won't resolve it.

0

Is there a problem that two different users (with two different phone numbers) will get the same generated 4 digits code?

It is not a matter of how many numbers we can generate from 4 or 6 digits (because, regarding the number of population, the number of combinations we can do with 4 or 6 digits is not significant and does not make a difference). Also, even with 4 digits PINs, lot of combination are rarely used:

enter image description here

Studies proved that a four digit number is easy for the human brain to remember. It was such studies that helped banks to decide on the number of digits that must be used when you pay with your credit card in a shop. Given this information, you may guess that if you type your PIN code in front of an attacker who has been observing you, he/she could easily remember the movements of your fingers (or see clearly where you typed) which thing can not be done with a 6 digits number.

  • This is highly speculative. We're not talking about long term pins. – Navin Apr 23 '18 at 1:52
1

The use of six digits allows you to have one million available combinations.

While you state "Is there a problem that two different users (with two different phone numbers) will get the same generated 4 digits code? if this is a problem, obviously 6 digits code won't resolve it" - well actually, no - a six digit code gives you more available numbers and for a company with a userbase measured in hundreds of millions of users the available combinations is an important factor.

The generation of verification codes is also discussed in this Stack Overflow question: "How to generate a verification code/number?".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.