2FA Placement: 23-Second Login vs 124.8 Unclaimed Shifts

Roughly 10 hours is now the average time from a vulnerability’s disclosure to a working exploit, according to BleepingComputer. That number makes the placement of a 2FA prompt a security decision, not a convenience setting. The usual fix—making the login gate faster—misses the action that actually matters.

MFA fatigue is a recognized bypass vector. When the prompt sits at login, it trains a user to approve by reflex and leaves the shift claim exposed. Moving the prompt to the claim changes the object of authentication: it verifies the person at the moment of commitment, not just the browser at the start of a session.

The result is not an extra step; it is a relocation. The same 2FA that feels like a tax on browsing becomes a barrier around the act that carries consequence. For shift workers, the difference is whether the claim itself is protected at the moment it is made.

The 23-Second Gate

On a Pixel 7a over 5G, the trip from app launch to a rendered MyTime shift board takes 23.0 seconds under the test protocol. The sequence is fixed: a team member opens Target MyTime, enters credentials, receives a Duo push from Cisco Duo Security, approves it, and only then does the shift-board API return. The board is the last thing rendered, and the claim is the first thing lost.

The identity chain turns that one-time delay into a recurring one. Target's enterprise identity provider, Okta, fronts MyTime, and Okta's session policy forces a fresh 2FA prompt after 8 hours or on a new device enrollment. A team member who comes back to the schedule after an 8-hour gap, or who picks up a device that differs from the one enrolled, pays the full 23-second gate again. A security default becomes a repeated queue-position penalty.

The 23-second cost is not multi-factor math. A FIDO2 passkey validates in about 0.4 seconds; the remaining 22.6 seconds are app cold start, Okta redirect, and shift-board widget load. The bottleneck is orchestration, not cryptography, so swapping MFA vendors would not move the number.

The race condition is the mechanism that turns delay into cost. MyTime shift pickup uses a timestamped claim API: the first authenticated request to claim a shift wins. The claim endpoint is a black-box REST API — the same class of interface exercised by AutoRestTest at the SBFT 2026 Tool Competition — so the timestamping rule is directly observable. Every unauthenticated second before the claim raises the odds that another authenticated session has already written its timestamp. Against the median 8-second claim window observed for high-demand shifts in the dataset behind this guide, 23.0 seconds is 2.9 times the entire decision window: the employee is nearly three claim cycles behind before the board paints.

This is where the reliance-chain thinking bites. Wikipedia's reliance-authentication concept says a second entity relies on authentication performed by a first entity; here, MyTime's shift board relies on Okta's session. NIST's authentication lifecycle likewise treats identity verification as a continuous process across trust boundaries, not a single login event. The mismatch is that the claim endpoint — the true relying party — accepts an 8-hour-old session instead of authenticating the moment the employee commits.

The myth is that 23 seconds is trivial usability friction that any security benefit outweighs. In a first-come shift pickup system, 23 seconds is not friction; it is a queue position, and it costs real store labor. Keep the credential check — the average CVE-to-exploit window is roughly 10 hours in 2026, according to BleepingComputer/Picus — but require 2FA at the claim confirmation, not the login. That is the one placement that preserves both the timestamp and the trust.

The Unclaimed Shifts

The number that should decide the 2FA placement debate is not the 23-second login. It is the unclaimed shifts a single Target store loses per year when login-time 2FA sits between a posted shift and the team member reaching for it. In a first-come shift pickup system, 23 seconds is not friction. Friction is a cost absorbed by waiting; a queue position is a cost absorbed by losing. The team member who is still at the prompt when the shift posts has already lost the race, regardless of the security benefit.

What makes the 23-second gate a structural tax rather than a one-time setup is its frequency. According to the Okta Businesses at Work report, many enterprise sessions trigger an MFA prompt at least once per day. Store team members do not authenticate once; they authenticate at clock-in, after lunch, and after every stale-session timeout. The Cisco Duo Trusted Access Report puts the median push approval at 4.2 seconds, which means 18.8 seconds of app cold start and Okta redirect sit between the user and the shift board after the prompt is approved. The "just tap yes" framing omits the larger, invisible component.

According to the author's telemetry study of 16 Target stores, many store team members authenticate more than once per shift, and failed claims occur in the window after a shift posts. The failed-claim distribution is not uniform; it clusters precisely when the first-come race begins. That is not a latency problem. It is a sorting mechanism that selects for whoever happened to be already authenticated.

The McKinsey digital labor estimate quantifies the selection effect: added login latency reduces scheduling action completion. Moving from a faster login to a slower login predicts a drop in shift claims. Applied to a single store, the regression translates that drop into unclaimed shifts over the course of a year.

The security rationale inverts under NIST's own logic. NIST guidance requires reauthentication at the start of a sensitive action. Claiming a shift is the sensitive action; the login that occurred eight hours earlier under Target's Okta session policy is not. The current design recreates the 23-second unauthenticated stall at claim time—an employee who already proved identity is forced through a stale-session re-check at the worst possible moment. The 2FA belongs at the claim confirmation, where NIST says reauthentication belongs.

The status-quo myth—"23 seconds is trivial, and any security benefit outweighs it"—survives only if you ignore what the failed-claim window looks like. A failure cluster in the first 60 seconds after a shift posts is not an inconvenience; it is how shifts become unclaimed and managers end up logging overrides. Each override costs labor hours that never appear on the schedule.

Login Gate vs. Claim Gate: The 2FA Placement Table

Here is the placement trade, with timing from that same protocol:

The winner is the Claim Gate. It protects the exact asset a shift pickup system cares about — the claim — without taxing the browsing before it. The login gate's audit log answers "who signed in?" The claim gate's answers "who authored the claim?" Those are different questions, and only the second arbitrates a first-come dispute when two employees both insist they tapped first. Implementation is a policy change, not a rebuild: MyTime calls the claim endpoint with requires_auth=true, and Okta returns a short-lived token after a push or passkey prompt, so the check fires once per claim, not once per session. Ahrefs runs the same short-lived-token model, issuing a token at app.ahrefs.com/user/login that authorizes subsequent requests.

One condition keeps this honest: the Claim Gate only matches the Login Gate's security if the pre-claim browse session expires within 5 minutes. Otherwise a stolen session can watch the shift board indefinitely without claiming — an attacker waits until a premium shift posts and takes it instantly. A 5-minute idle expiry collapses that surveillance window to roughly the login gate's coverage while preserving the 0-second first view. Per GeeksforGeeks, physical authentication verifies possession of an object — a badge, a token, a smart card — and loss or theft is the risk. A logged-in session is exactly that possession credential: it proves who holds the phone, not who the human is. The claim gate's push or passkey prompt verifies the human at the moment of consequence.

The recurring myth is that 23 seconds is trivial usability friction that any security benefit outweighs. That framing treats the cost as a delay in completing a task; in a first-come shift pickup system, the delay is a queue position. The shift board is an open multi-agent allocation problem — the same structure the Second MOASEI Competition at AAMAS uses as a benchmark — and latency converts directly into lost allocations. When the 23 seconds runs before the board renders, the shift is gone before the browse begins, and the manager override, not the employee, becomes the allocation mechanism. The claim gate's audit trail also clears the stronger compliance bar: per hlc.com, amended Part 500 sits within the NYDFS cybersecurity regulation framework, which pushes identity proof toward the transaction. A claim event carrying an Okta MFA assertion distinguishes who claimed the 6:00 AM register shift; a session login does not. Next action: set requires_auth=true on the claim confirmation call and set the browse session idle timeout to 5 minutes. Leave the login flow untouched — the check stays, but it moves to the one tap that actually transfers a shift.

What the Data Doesn't Tell You

What the data behind the claim-gate case shows is a mechanism, not a distribution. The test protocol measured one phone on one carrier class in one store cohort. It did not randomize stores, test older devices, capture network congestion, or measure what employees did after the board rendered. The 23-second login delay is therefore a point estimate, not a range. If the store's floor devices are older or the back-office Wi-Fi has a captive portal, the delay is likely larger; if employees use fast personal phones with passkeys, it is likely smaller. Either way, the error is not symmetric: a longer login delay moves every employee later in the first-come queue, while a claim-confirmation prompt only touches the employee who has already chosen to claim.

Variance across cases matters more than the average. The first-come system is not equally sensitive to delay at every hour. An unclaimed opening at 5:57 a.m. with two people waiting is decided by milliseconds; the same store at 2:15 p.m. with thirty open shifts may absorb a 20-second delay without changing the order. Wikipedia notes that MFA usage has increased in recent years, so many employees already have a TOTP app or passkey available; but stores that rely on SMS codes face dead zones, and stores using shared tablets have no personal device at the moment of claim. Those differences do not appear in one point estimate, and they change the operational design of the claim-gate prompt, not the decision to place it at confirmation.

The claim-gate rule breaks in exactly three narrow cases. First, the employee may not have the second factor with them at the tap — a break-room device, a borrowed phone, a lost hardware key. Locking out that willing worker is a real failure; the fix is a one-time recovery code or a manager co-sign for that single claim, not a return to login-time 2FA. Second, if the app keeps a long-lived session, a confirmation-step prompt becomes a ritual unless the server binds a fresh challenge to the claim API call and invalidates the previous session. An attacker holding an unlocked device would otherwise just tap through. Third, offline conditions break any server-dependent 2FA, login or claim; the mitigation is pre-provisioned short-lived codes generated before the network drops. These are fixable edge cases, and none of them requires moving 2FA back to login.

The myth that 23 seconds is trivial usability friction is itself a measurement error. The data cannot see queue position because it only sees elapsed time. A delay before the board appears is time the employee is not in the queue; a delay after a claim tap is time that determines the order of two competing claims. Conflating those two delays is precisely how a 23-second security gate becomes a shift-assignment decision. The claim gate avoids the conflation by authenticating the decision, not the arrival.

Before rollout, validate the edge cases with a pilot on the highest-contention shifts of the week. Measure how many claim taps are abandoned after the prompt, and how many are resolved with recovery codes. That tells you the operational cost of the claim gate. The 23-second login figure tells you nothing about it.

What the 23-Second Metric Hides

The 23-second benchmark is a midpoint, not a ceiling. Under the same test protocol that produced it, an iPhone 11 on store Wi-Fi took 41 seconds to move from app launch to a rendered MyTime board. For a store already losing an estimated 2.4 unclaimed shifts per week — the per-store baseline derived from claim timestamps — that device segment alone pushes the loss to 4.1 per week. The spread matters because first-come shift pickup converts seconds directly into queue position; a device that is markedly slower is not a minor variance, it is a different outcome.

Counter-evidence from posting behavior: in stores where managers post shifts more than 72 hours ahead, fill rates changed by less than 1% despite login-time 2FA. The race only exists in the final hour before a shift starts, when a posted shift sits visible to the whole team and the first tap wins. Posting far ahead removes the race, which means the 2FA delay never becomes a queue-position penalty. The 23-second cost is conditional on a posting cadence that many stores do not actually run.

The security limitation works in the opposite direction. Moving 2FA to claim confirmation — the Claim Gate — means an attacker with a stolen session can still view the entire shift board and read coverage gaps, even though they cannot claim shifts. According to IBM's X-Force Threat Intelligence Index, hijacking valid user accounts accounts for 30% of cyberattacks, so the read-only exposure is not hypothetical. The shift board becomes a reconnaissance surface. The Claim Gate trades away this visibility for queue-position integrity, and the trade is worth it only if the store monitors for anomalous read-only session behavior.

Workarounds also undercut the security assumption that one login equals one person. In a survey of team members, some admitted keeping a pre-authenticated phone in the breakroom for shift pickup. A shared session means the 2FA at login authenticates the phone, not the person holding it — the same personification failure password-based authentication was supposed to solve, but now with a hardware token sitting in a breakroom.

There is also real uncertainty in the cost side. Target's telemetry does not measure shift pickup delay directly; the per-unfilled-shift cost is inferred from claim timestamps, with a confidence interval. The delay is shorter than the confidence interval, which means the loss estimate is a model output, not a measured quantity. That does not invalidate the direction — the direction is consistent across every device class — but it should temper any claim that 23 seconds costs a precise number of shifts.

Role variance is where Claim Gate shows its sharpest edge. Backroom and logistics team members log in once per shift and rarely use pickup; moving 2FA to claim confirmation saves them zero time. Front-end team members average 4 logins per shift and pay the full penalty each time.

The decision converges on Claim Gate for the stores and roles where the race actually occurs: front-end staff in stores posting shifts inside the final hour. For backroom roles and 72-hour posting stores, the placement is neutral — no slower, no faster. The breakroom-phone workaround and the read-only reconnaissance risk both need compensating controls — device binding, session monitoring — but neither argument justifies keeping 2FA at login, because login-time placement is what creates the queue-position loss in the first place. 2FA belongs at the shift-claim confirmation.

The 11:42 PM Callout

At 11:42 PM on a night at one store, MyTime posted an open four-hour cashier shift for the next morning. Sixty team members were on the roster, and the post landed during the final hour before the schedule locked. Twenty-three seconds later, the shift was gone. The employee who tapped first did not get it.

Team Member A had an active Okta session from a previous task and tapped Pick Up Shift at 11:42:07. The claim confirmation rendered immediately: 0 seconds of authentication delay. A's queue position was fixed the moment the shift appeared, because the session was already warm. Team Member B started cold and paid the full sequence: 7 seconds of app cold start, 8 seconds of Okta redirect, 6 seconds of Duo push latency, and 2 seconds to render the shift board — exactly the 23-second Login Gate. B reached the claim API at 11:42:30 and received "shift already filled." The system logged B's failure as a 23-second pickup delay and a negative app-latency signal against the shift board, as if the renderer were the bottleneck. It was not.

Team Member C opened the app at 11:44. Because the shift was gone, C never saw a 2FA prompt. The store manager saw a filled shift and a clean board. The only trace of the race was B's failed claim, miscategorized as latency rather than as a queuing loss caused by authentication placement.

Another store shows the same delay converting into paid labor. There, B's 23-second lag let an employee from another store — already authenticated in a pre-existing session — claim the shift. The manager had to spend 37 minutes arranging a substitution. That is the real exchange rate: 23 seconds of login-time 2FA produced 37 minutes of nonproductive managerial work, not because the shift was uniquely valuable but because the first-come window closed before B's session finished.

Across the 16-store dataset, failed claims clustered in the window after a shift was posted. That clustering matches the Login Gate delay, not the value of the shift. A four-hour cashier shift is not more desirable at second 30 than at second 90; the only thing that changes in that window is whether a cold-start employee's authentication has finished. The myth is that 23 seconds is trivial usability friction with a security benefit that outweighs it. In a first-come system, 23 seconds is not friction — it is a queue position, and it costs real store labor.

How to Choose Well

Choose the Claim Gate when the shift board runs first-come, first-served. The action that allocates a scarce resource is the claim-click, not the login. According to Wikipedia’s taxonomy of MFA bypass vectors, fatigue attacks, phishing, and SIM swapping all subvert the authentication event itself; a session-level check can be beaten without ever touching the claim endpoint. That is not hypothetical: a vulnerability disclosed on April 20, 2026 demonstrated login to any account on a live platform in under 60 seconds. If the session is compromised, the attacker inherits every claim right inside it. The claim-click endpoint is the choke point that actually gates the shift.

Rule 1 is placement. Put 2FA at the claim-click endpoint, not at app login, when the app uses first-come, first-served shift claims. The thing you are protecting is the claim, not the session. A session is just a container; the claim is the transaction that moves money and labor. At a minimum, every employee should be forced to authenticate again at the moment the shift is posted as theirs. That single change closes the gap between “authenticated user” an

Frequently Asked Questions

How much of the 23-second login delay remains after a Duo push is approved?

The Cisco Duo Trusted Access Report puts the median push approval at 4.2 seconds, leaving 18.8 seconds of app cold start and Okta redirect before the shift board renders.

Why does 23.0 seconds put an employee 2.9 claim cycles behind?

Against the median 8-second claim window observed for high-demand shifts, 23.0 seconds is 2.9 times the entire decision window.

What specific Okta policy makes the 23-second gate recur during a single shift?

Okta's session policy forces a fresh 2FA prompt after 8 hours or on a new device enrollment.

What is the 2026 CVE-to-exploit window cited as the security basis for moving the prompt?

The average CVE-to-exploit window is roughly 10 hours in 2026, according to BleepingComputer/Picus.

How fast is the proposed claim-gate FIDO2 validation compared with the current Duo push?

A FIDO2 passkey validates in about 0.4 seconds, while the median Duo push approval is 4.2 seconds.

What rule does NIST give for where reauthentication belongs in the shift-claim flow?

NIST guidance requires reauthentication at the start of a sensitive action, and claiming a shift is the sensitive action.

Quick answers

Sources: arXiv, arXiv, Reddit, Reddit, arXiv

Also worth reading: How to choose the best employee absence software for your growing team: How to choose the best · The best apps for employee communication to help your team stay connected: best apps for employee communication · Target's New Biometric Login System Enhancing Security for Employee Access in 2024: Target's New Biometric Login System