Where the sixteen comes from and what it improved
The same cut as the short form, taken twice as deep. Keep the last 64 bits of the fingerprint, write them in hex at four bits a character, and sixteen characters come out. The definition is that plain and the value is counted.
The improvement over the short form is not small. Thirty two extra bits multiply the search space by roughly four billion. If that were the end of the story this page would be a footnote, and the advice would be to use the long id and stop worrying.
It is not the end of the story, because matching values at this length have been produced deliberately and published more than once. That moves the risk out of the category of things that are possible in principle and into the category of things somebody has already done and shown you. The difference matters when you are choosing what to rely on rather than what to argue about.
The argument against sixteen
Take the three options together. Eight characters nobody defends any more. Forty characters is the value the specification defines and the value current tooling prints without being asked. Sixteen sits between them and manages to inherit the worst property from each side.
From the short form it inherits attackability. Sixty four bits is a large number to a person and a moderate one to hardware built to repeat a single operation. The published demonstrations were not the work of a state. They were people making a point with equipment they already owned.
From the full fingerprint it inherits credibility. Sixteen characters looks serious. It fills a line, it does not read as a shorthand, and somebody who has heard the short id is broken will read the long one as the repaired version. That belief is the actual damage. A value nobody trusts is harmless. A value that is weak and trusted is the combination worth avoiding.
Nothing is saved by staying in the middle. The full fingerprint is no harder to obtain, no harder to store and no harder to print. Sixteen characters saves about twenty four characters of width, which is a saving nobody needed and a risk somebody chose.
Why sixteen keeps getting recommended
It survives because it was once good advice. When the short form fell over, the immediate practical fix was to use the longer one, and that advice went into guides, posts and habits that outlived the moment they were written for. It still reads as current, because nothing about the sentence looks dated.
The second reason is a misreading of what happened. People treat the long id as the modern replacement for the short id. It is not. The replacement is the full fingerprint, and the long form was an intermediate step that got overtaken while the guides were still being written.
The third is an argument about rates. Somebody points out that matching a 64 bit value costs real compute and asks who would spend it on them. Nobody spends it on you. The cost is paid once against a key that many people quote, and the result is then reused against everybody who compares sixteen characters. The economics run the same way as the address openings on the eight character prefix page, where one forgery serves thousands of readers.
What would move the sixteen
Nothing will. There is no proposal for a 24 character id or a 32 character one, because the trouble was never that the truncations were too short. The trouble is truncation, and the remedy has been sitting in the specification the whole time.
What can change is what your software shows you. Most current tools print the full fingerprint by default and some refuse a lookup by any short form. Output that still leads with sixteen characters is usually a setting rather than a limit.
Use the full forty. Print it in ten groups of four when a person has to read it by eye. Neither of those costs anything at all, which is what makes the middle option indefensible rather than merely weak.
Questions people ask
Have matching 64 bit ids really been produced?
Yes, deliberately and in public, as demonstrations rather than as attacks on anybody. That is exactly why they belong in a decision about what to quote.
Is the long id safe for local use?
Locally you could use any label at all, including one you invented. The problem starts when the value crosses between people and begins to be read as evidence.
What should I put in a message instead?
The full fingerprint, or a signed message plus a pointer to where the fingerprint can be obtained independently. The forty page covers the second half.