Two-Factor Authentication - Unrealistic Code/Password Request Expirations

[Pokerface]

Received an e-mail from RioBet Affiliates that they have initiated a Two-Factor Authentication code for accounts. It also states that the code expires in "10 minutes".

Really? Do these programs really think we sit at our computers every minute of the day checking e-mails and expect us to "jump"? 10 minute expiration?

Whoever thinks these things up really must re-evaluate how people work and set more realistic time frames before expiring codes and passwords.

Same goes for requesting new passwords. When we need a new password and the program says it will be sent shortly and we wait and wait and wait. It eventually arrives and expires in 30 minutes but in the meantime you have gone off and doing other things and now have to request another password and so the circle continues.

Security is important to everyone but there must be a better process than unrealistic expiration of codes and passwords.

Just a thought ...... Think from a users perspective also.

[universal4]

10 minutes is enough, as long as the code comes immediately.

Rick
Universal4

[Pokerface]

Very true, 10 minutes for passwords is sufficient. In the case of RioBet no request is made, they are just sending the two-factor code that expires in 10 minutes. Just worse when they are sent at 3am EST when we are still sleeping. LOL

[TheGooner]

Very true, 10 minutes for passwords is sufficient. In the case of RioBet no request is made, they are just sending the two-factor code that expires in 10 minutes. Just worse when they are sent at 3am EST when we are still sleeping. LOL

That sentence raises huge alarm bells for me.

It's unlikely that they are sending these codes randomly as you suggested.
It's far more likely that someone has entered your userID / email and asked for a password reset.

You're possibly in the first stages of being hacked - and should discuss with your AM immediately

[universal4]

Was my thoughts after reading his reply also.

Rick
Universal4