In the 28 August 2019 call, @agl suggests we set timeout defaults differently for different operations.

From the call of 2019-08-28:

As I understand it, the primary motivate for RPs wanting a timeout is in the traditional, U2F-like flow where a password is used to establish user verification and the security key touch is user presence (and anti-phishing). In this case, the time between the password and the touch matters because you want to ensure that it's the same person doing both.

However, that argument isn't as clear for credential registration (and nor for assertions with UV). Therefore we might be able to set a high timeout floor for registrations without breaking anyone's timeout needs.

We are doing some user studies around this and will come back on a recommendation of appropriate time.

What we are seeing is the typical timeouts for bio-enrollment + User verifications it taking around 4 minutes.

Suggesting:
For User presence only operations: 30 seconds to 180 seconds with a default value of 120 seconds.
For user verifications operations: 30 seconds to 600 seconds with a default value of 300 seconds.

Opened PR #1317.