diff --git a/gui/backend.go b/gui/backend.go
index f8ee2bdb5d92bf9fad2a9a1d1b185e59358dfb66..9453d88f860ba9b9e31e3806e181e6b9ceb3f8f4 100644
--- a/gui/backend.go
+++ b/gui/backend.go
@@ -3,7 +3,6 @@ package main
 /* a wrapper around bitmask that exposes status to a QtQml gui.
    Have a look at the pkg/backend module for further enlightment. */
 
-// #cgo CXXFLAGS: -mmacosx-version-min=10.10
 import (
 	"C"
 	"unsafe"
diff --git a/gui/qml/main.qml b/gui/qml/main.qml
index 80f8e7cad14a9577ef6df132d192d2bc4bbd17a0..ce72fffc84114b8f6c2f49f8bc361e0af13d82d6 100644
--- a/gui/qml/main.qml
+++ b/gui/qml/main.qml
@@ -48,7 +48,7 @@ ApplicationWindow {
     function showInitFailure(msg) {
       console.debug("ERRORS:", ctx.errors)
       if (msg == undefined) {
-          if (ctx.errors == 'bad_auth_502') {
+          if (ctx.errors == 'bad_auth_502' || ctx.errors == 'bad_auth_timeout') {
                   msg = qsTr("Oops! The authentication service seems down. Please try again later")
               initFailure.title = qsTr("Service Error")
           }
diff --git a/pkg/backend/api.go b/pkg/backend/api.go
index 1d44f8a5063b181b0044ece75b8ed43520255f13..4390fef7c1e71adec76ea3811a5e18fea74b52ba 100644
--- a/pkg/backend/api.go
+++ b/pkg/backend/api.go
@@ -18,10 +18,12 @@ import (
 func Login(username, password string) {
 	success, err := ctx.bm.DoLogin(username, password)
 	if err != nil {
-		log.Printf("Error on login: %v", err)
-		if err.Error() == "Cannot get token: Error 502" {
+		if err.Error() == "TokenErrTimeout" {
+			ctx.Errors = "bad_auth_timeout"
+		} else if err.Error() == "TokenErrBadStatus 502" {
 			ctx.Errors = "bad_auth_502"
 		} else {
+			log.Println("ERROR: bad login", err)
 			ctx.Errors = "bad_auth"
 		}
 	} else if success {
@@ -29,7 +31,6 @@ func Login(username, password string) {
 		ctx.LoginOk = true
 		ctx.LoginDialog = false
 	} else {
-		// TODO: display login again with an err
 		log.Printf("Failed to login as %s", username)
 		ctx.LoginDialog = true
 		ctx.Errors = "bad_auth"
diff --git a/pkg/vpn/bonafide/auth_sip.go b/pkg/vpn/bonafide/auth_sip.go
index 5da562d550a53e4fb62c4f3dda260804b6268816..cc9d967db73c81e6e26504e7c0ff3cfdffc3bae6 100644
--- a/pkg/vpn/bonafide/auth_sip.go
+++ b/pkg/vpn/bonafide/auth_sip.go
@@ -44,15 +44,21 @@ func (a *sipAuthentication) getToken(user, password string) ([]byte, error) {
 	}
 	credJSON, err := formatCredentials(user, password)
 	if err != nil {
-		return nil, fmt.Errorf("Cannot encode credentials: %s", err)
+		log.Println("ERROR: cannot encode credentials.", err)
+		return nil, fmt.Errorf("TokenErrBadCred")
 	}
 	resp, err := a.client.Post(a.authURI, "text/json", strings.NewReader(credJSON))
 	if err != nil {
-		return nil, fmt.Errorf("Error on auth request: %v", err)
+		log.Println("ERROR: failed auth request", err)
+		if os.IsTimeout(err) {
+			return nil, fmt.Errorf("TokenErrTimeout")
+		} else {
+			return nil, fmt.Errorf("TokenErrBadPost")
+		}
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != 200 {
-		return nil, fmt.Errorf("Cannot get token: Error %d", resp.StatusCode)
+		return nil, fmt.Errorf("TokenErrBadStatus %d", resp.StatusCode)
 	}
 	token, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
diff --git a/pkg/vpn/bonafide/bonafide.go b/pkg/vpn/bonafide/bonafide.go
index 973416a62bbba23add1142638a801fa6ad1bef94..4203ba2904233a6e3eb21e502c5ff52ebeb9c4fd 100644
--- a/pkg/vpn/bonafide/bonafide.go
+++ b/pkg/vpn/bonafide/bonafide.go
@@ -85,6 +85,7 @@ func New() *Bonafide {
 				RootCAs: certs,
 			},
 		},
+		Timeout: time.Second * 10,
 	}
 	_, tzOffsetSeconds := time.Now().Zone()
 	tzOffsetHours := tzOffsetSeconds / secondsPerHour
@@ -129,6 +130,8 @@ func (b *Bonafide) DoLogin(username, password string) (bool, error) {
 	}
 
 	var err error
+
+	log.Println("Bonafide: getting token...")
 	b.token, err = b.auth.getToken(username, password)
 	if err != nil {
 		return false, err