On a service which includes a lot of sensitive info in digital input forms, how long before timeout should you display a warning message?
Someone proposed a 15 minute session with a timeout warning at five minutes, but I suspect (but can't justify why) that that will be annoying and there's a reason warnings usually come at one or two minutes from timeout.
Is there a best practice guide for this, or particular reason that warnings are usually shortly before timeout?
Cheers
I'm not sure if there is a best practice guide for timeout length and warning timings because most of these would be governed by the sensitivity of the content and the usage scenarios.
For instance, if you have highly sensitive content and users that move away from their desks frequently and for long periods the you would want a short timeout/warning set. If, however, you only have mildly sensitive content and users who only leave their desks very briefly and not very often, then you can afford a much longer timeout.
If the content you are working with requires lots of interaction then you can offer a short timing for the warnings as this will rarely occur. On the other hand, if your content requires lots of reading/watching/thinking between interactions then you don't want to bother your user with timeout warnings so often so need to use a longer timing for them.
In short, the timings you use for your warnings and timeouts should be governed by your particular use-cases. Check how your users are behaving around the system and use that information to set your timings.
