The second step at login can now be a long password with letters and symbols instead of six digits. Android also gets more information about calls from unknown numbers, and passkeys are no longer limited to one.
- Two-step verification is now a full password: longer, with letters and special characters.
- On a call from a number outside your contacts, Android shows whether it is from another country and whether you share groups.
- Passkeys passed a billion people, and you can now hold more than one.
Six digits. That was what stood between a stranger holding your one-time code and your whole WhatsApp.
There is no vulnerability number here and none is expected. Nobody got in anywhere. This is a change to the default, made before it was needed.
Which of the three actually works
The second step. It is the protection that holds once an attacker already has your one-time code, and that is the usual move in a messenger account takeover.
Six digits are a million possibilities and they fall to patience. A password with letters, digits and symbols changes the order of magnitude. The change is small and arrives without fanfare, but it lands exactly where things break.
Second by weight is allowing several passkeys. Until now the key was single and tied to one device, which made it a breaking point. A lost phone sent people back to codes over messages, which is the weakest link in the whole chain.
Worth noting
The call context is Android only for now. Meta does not say when it reaches iPhone and does not pretend otherwise, which is fair.
If you do one thing today, make it the second one: open the settings and swap the six digits for a password. It takes a minute and it is the only one of the three that depends on you.