If it lasts longer than 20 minutes, you're doing it wrong. But more importantly, are we talking about hiring a security expert? Or hiring for a product development team? Or hiring for the devops team? Context is rarely given in the "whiteboarding issue" discussion, e.g. at HN. I currently hold candidate interviews for a solution architect role, and I certainly don't want to hire someone who can't hold a whiteboarding session with a client or their partner's SME.