Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I type my password to login to Win or Linux.

Case 1: I get it right. Almost instant reaction.

Case 2: I misspelled it. It takes a while, and then rebounds.

Why does it takes longer to identify a wrong password vs a correct one? shouldn't the time to identify be the same?

share|improve this question

migrated from programmers.stackexchange.com Mar 23 '13 at 2:05

This question came from our site for professional programmers interested in conceptual questions about software development.

6  
Duplicate of unix.stackexchange.com/questions/2126/… –  MichaelT Mar 22 '13 at 22:03
    
anti brute forcing, I have seen a system where repeated failed attempts increase the delay exponentially –  ratchet freak Mar 22 '13 at 22:23
2  
Purposely adding a delay is often referred to as "tarpitting": en.m.wikipedia.org/wiki/Tarpit_(networking) –  Danny Tuppeny Mar 23 '13 at 23:41

4 Answers 4

up vote 18 down vote accepted

It takes the same time to verify a wrong password and a correct one. But, when the password is wrong, the operating system makes you wait a bit. This is a security feature, to discourage people who try "potential passwords" (in particular people with some electronic skills, plugging in some circuitry which the computer will consider to be a keyboard, but which in reality tries a lot of passwords real fast).

Such things don't work as well in a network context (if the attacker wants to try 100 passwords quickly, he can open 100 connections in parallel) but the password verification code is often shared between network and local logon.

share|improve this answer

When you enter incorrect credentials, the operating system connects to the domain controller (for Windows or the equivalent for other operating systems) to see whether your credentials have changed (e.g. a password reset by the admin, locked out from failed authentication attempts on another DC). This may take a few more seconds, particularly if the DC is busy or remote.

This is separate from an added delay. Windows, for example, will add an increasingly large delay after the third and subsequent failed login attempt in case the user is attempting to guess a user name rather than just a password.

share|improve this answer
1  
Are you saying that if the credentials have recently changed on the domain controller so that a particular password is now wrong, then it might still be accepted? (That appears to follow from your explanation about domain controllers--you appear to be saying that credentials are cached locally and, at least some of the time, only updated or checked when a username/password combination appears wrong.) –  Eliah Kagan Mar 23 '13 at 12:15
1  
@EliahKagan See blogs.msdn.com/b/oldnewthing/archive/2010/03/23/9983312.aspx for a better explanation. In short, yes this may occur although the window of opportunity is very small. –  akton Mar 23 '13 at 21:46

Identify yes, but you have to then check the policy for lockout, get/update the recent bad attempts from the domain, log the security events etc.

Also, some systems just add a delay to slow down someone from trying usernames dictionaries and such.

share|improve this answer

It's likely a security thing. If a bad guy could try thousands of passwords as fast as they could type (or automate!), they could break in fairly quickly. If each failure costs them several seconds, the system becomes orders of magnitude harder to attack with brute force.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.