Two Step Verification. 4 digits vs 6 digits

Question

From a security level standpoint (such as Server, DataBase, Token Code, Authorization, Authentication, etc.) in regarding the Two Step Verification, usually Apple send a total of 4 digits security code vs Google send a total of 6 digits security code. What are the main differences?

Answer 1

The number of digits in such a one-time password is determined by the acceptable risk that an attacker who doesn't receive the verification code will be able to guess it (lucky guess). This risk takes into account several factors:

• the probability that an attacker will be able to guess;
• the negative consequences of an correct guess by an attacker;
• the probability and the negative consequences if the code is too long and this discourages the user to use the service.

For an $n$-digit code, if there is a single valid code and the code is generated at random, then the probability of a lucky guess is $10^{-n}$. That's 1/10,000 for a 4-digit code, 1/1,000,000 for a 6-digit code. These are usually acceptable figures when the one-time code is a second factor (usually complemented by knowing a static password or possessing a physical device); they would be grossly insufficient if the code alone was enough to access a service.

When the code is sent from a remote server to the user's device, there is generally a single valid code which is randomly generated. Some one-time password schemes don't require communication between the server and the user's device, but instead have both sides generate a pseudo-random code in the same way using a shared secret key and a counter. In this case, there are usually several valid codes, to allow for desynchronization between the client and the server; this requires a slightly longer code to compensate for the increased number of possible lucky guesses.