We are setting up Multifactor authentication for a Single Sign On project. Anytime a new device is detected, a PIN is sent to their email or sms (user chooses). How long do you suggest this PIN be valid till? It is set to 5mins right now. Is that enough time?
Added this: Also, the system currently has it where the 'resend pin' button is available for only those 5 mins. If the user doesnt enter the PIN or 'resends pin', he is redirected back to login. Is that right?
While the amount of time that a PIN is valid for might have something to do with user experience, I would suggest that the first consideration is the potential security risk if you allow the PIN to be valid for longer than what is necessary (and therefore more of a security question first before optimising the user experience).
What I have seen implemented on various major platforms seem to have a shorter period of time for the expiry of the PIN, at least if you look at bank authentication apps (which might have higher security requirements) or for corporate/work applications (which has its own security policy). I believe that 5 minutes is longer than what is required and that somewhere around 1 minute is sufficient.
From the user's perspective, as long as you can make it clear that the length of time is sufficient for the user to provide the input (and it is not an unreasonable amount of time), then there are strategies you can use to deal with the expiry of that PIN by allowing the user to request another PIN. You may consider whether this time should be different for SMS and email options, or make the time long enough to cover both use cases.
Michael Lai seems to have a pretty good answer, but I just wanted to add a few things.
Five minutes is a pretty good time. I think that's pretty reasonable, but there may be a need to differentiate between the email and SMS PIN codes. It's pretty fast for an SMS message, so even 2 minutes would probably work. For email, 5 minutes is good, but if the user still needs to sign in to their email, it may take more than five minutes. I would say 7:30 for email, just to be safe.
