[dkokelley]

The phone call you receive will give you a three-digit security code. Enter the code, and you'll be logged into your email account immediately.

3 chars. There are only 1,000 ~ 250,000 combinations depending on if they are alphanumeric or not, and if they are case sensitive.

They should make the key expire after about a minute (or 3 attempts) to slow brute forcing.