I can understand why they would allow a code to be used during up to 1 mn after it has been generated (to avoid the disappointment caused by the use of the authenticator right before it generates a new one). But 11 mn oO