Currently, the recovery codes in OATHAuth have infinite lifespan. This is fine for the typical use of recovery codes (store safely and use in emergency). However, codes generated with Special:Recover2FAForUser are potentially known to a few intermediary parties (all those who can access the target user's email inbox, now and in future).

This makes it possible for a future attacker, who gets access to the target user email, to grab recovery codes and try them to log into Wikimedia wikis, hoping they weren't invalidated. In order to mitigate this, codes generated by this special page should be short-lived.

Acceptance criteria

• Recovery codes generated by Special:Recover2FAForUser can be used only for 7 days after they have been generated.