During a recent audit our security guys pointed out a 'feature' of the way the verified registration process works that is less than ideal.

The verification code generated is always of the format 0-XXXX (zero, hyphen, four digit number), and the four digit numbers are allocated sequentially.

This means that after generating a few legitimate accounts it is a simple task for anyone to figure out what the next verification code is likely to be and then create themselves bogus accounts and verify them without ever receiving the verification code.

I know that you could achieve the same result by using a service like 10minutemail.com to set up a temporary email address to get the verification code, but I would like to get at the code that allocates the numbers and change it to do something more random than just allocating them sequentially.

Does anyone know whereabouts in the code the allocation of verification numbers is done?  I assume its some where in the core modules code, and I would need to recompile after making any changes?

Cheers
Steve 

 we also have concerns about this verification code ... our website shows the total number of registered members to track our statistics and attract more people .... but this silly Verification Code formula is like:

[portal_id]-[user_id]

Where portal ID is always 0 for the default portal and Userid can be easily guessed from the site counter OR just by registering couple of times.

Can you guys please fix this issue?