I'd be happier if it was 24 hours by default, with an increased timeout configurable behind 2FA.