Even if it didn't outright display the code you need to enter, my guess is this and similar implementations hide further vulnerabilities like: the numbers aren't generated with a secure random number generator, or the validation call isn't resistant to simple brute force quickly guessing every possible number, or the number is known client side for validation, etc.

[–] no_username@lemm.ee 25 points 8 hours ago (1 children)

what if 435841 is the most secure 6 digit numerical code?

why use another?

[–] Valmond@lemmy.world 12 points 8 hours ago (1 children)

I use the random number 4, I even rolled a dice to get a real random number instead of those "pseudo" random numbers. (XKCD?)

[–] MHLoppy@fedia.io 12 points 7 hours ago

https://xkcd.com/221/

load more comments (3 replies)