If a user attempts to login using 2FA, and they get sent an email, there are a couple of scenarios that may occur:
- Code is valid and not expired: log user in.
- Code is valid but expired.
- Code is invalid.
For scenarios 2 and 3, should the message be the same or different? Here are the arguments for each:
- Users will know exactly what they have done wrong, and will attempt to send another token only when they realize the previous token has expired (mostly).
- If someone else is trying to verify the token, it will tell them that the token is valid but expired, and they will realize however method they used to acquire the token is correct.
- Users will not know what they did wrong and will attempt to send multiple tokens again and again.
- Attackers will not be able to verify whether or not the token is valid at all.