When designing IDs that a person may need to read, copy, type, or pass to someone else, usability matters as much as uniqueness. A lookup ID may have to be dictated over the phone, written down, or entered by hand. For arbitrary machine-generated lookup IDs, numbers are a particularly practical format for human communication. People already handle long numbers: credit card numbers are routinely read, copied, and dictated despite containing sixteen digits.

Numbers are also easier to speak than arbitrary letters and symbols. There is no need to distinguish “B” from “D,” explain capitalization, or say whether a character is the letter “O” or the digit “0.” A number can be read aloud.

For this reason we use a twenty-digit numeric lookup ID, written in four groups of five digits. The grouping makes the number easier to scan and check, following the same general principle as a credit card:

12505-89847-63568-88524

A lookup ID such as this looks like nothing more than a random string of digits. But the number itself can carry a small amount of hidden information. If designed correctly, this eliminates the need for the server to maintain a separate table mapping every ID to metadata.

QR codes are a convenient way to pair a mobile device with a desktop application or a web application running on the desktop: the desktop displays a code, and the phone scans it. But scanning the code does not prove which device scanned it.

Imagine an attacker standing nearby, watching through a hidden camera, or watching a screen share in an online meeting, who scans the pairing code with his own phone before the legitimate user does. Without another authentication step, the desktop could end up connected to the attacker’s phone instead of the user’s.

That can open the door to a social-engineering attack. An attacker who controls what appears in the paired session may impersonate contacts or otherwise manipulate the user into revealing sensitive information.

So how do you protect against this when the attacker can see almost everything? Assume he can observe the desktop screen, the phone screen, and the keyboard, and can scan any QR code shown on the monitor. With his own phone, he can do anything the user can do.

The only things he cannot do are physically operate the user’s phone or type on the user’s keyboard. Those are the only two meaningful advantages the legitimate user has. The pairing process has to build on them.