Don't put a 60 second limit to enter the code for recovery e-mail.
I was already signed into my alternate e-mail, and I noticed yahoo counting down while I was checking my e-mail. Usually, a person might need to sign into the alternate e-mail. That could take 60 seconds to sign in. Then the user would need to find the e-mail, then go back to the yahoo security options, and enter the code. That is a ridiculous setting to have a 60 second limit. It's not the same as sending it to a phone. Don't limit the time to check the recovery e-mail to get the verification code!