@seanmonstar A timeout is needed to make brute-forcing harder. We could reduce that number of seconds, but to preserve the strength of this scheme we'd have to shorten the lifetime of the PIN code or increase the number of digits in it. See https://github.com/mozilla/browserid-bigtent/issues/219#issuecomment-18193664