Ah, I should have been less glib :). "full-sized" means a full cryptographic value (128 bits, or maybe 256 for consistency), rather than a shorter easy-to-transcribe PIN code. The specific properties we care about are collision-free (no two generated tokens should ever be the same over the lifetime of the service) and unguessable given an attacker guessing verification codes as fast as our POST interface will let them. 256 bits will certainly be enough for that. 128 bits might too.