If a user attempts to login using 2FA, and they get sent an email, there are a couple of scenarios that may occur:

  1. Code is valid and not expired: log user in.
  2. Code is valid but expired.
  3. Code is invalid.

For scenarios 2 and 3, should the message be the same or different? Here are the arguments for each:

  • Different:
    • Users will know exactly what they have done wrong, and will attempt to send another token only when they realize the previous token has expired (mostly).
    • If someone else is trying to verify the token, it will tell them that the token is valid but expired, and they will realize however method they used to acquire the token is correct.
  • Same:
    • Users will not know what they did wrong and will attempt to send multiple tokens again and again.
    • Attackers will not be able to verify whether or not the token is valid at all.

Is an expired token not the same as an invalid token? At least from user experience it has the same result; not able to login. The only difference is that an expired token was valid once and a token that never existed not.

In other words, users don't care and from security perspective they are both invalid. Just tell the user that logging in is not possible and he/she should request another token. After that you can mention that there is a limited time to activate the code. Mention the same in the e-mail.


The way I see this - there are two scales you can evaluate your solutions by:

Usability wise, it is generally a good idea to let the user know more about what happened, because then there is more info to fix the problem. Like, some techie user would be less alarmed by a token expiring ("oh, that's normal") than it being invalid ("why? what happened? am I being hacked?"). On the other side, to a layman - it doesn't really matter, what happened ("something with a token..."). So, from the standpoint of usability, I'd say, it's better to use different messages, because for some users it can be helpful, while it does nothing bad for the others.

Security wise, it is generally a good idea to let the user know as little about how the system is working, so it's better to use the same message for both.

Now the real question is - to your usecase, which is more important: usability or security? Like, for a bank, security would be a top priority, while for, say, a public QnA website, usability could tramp privacy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.