I've implemented a password reset function for a website I'm working on. By default, the function is very fast, and I'm wondering if it would be helpful, from a security standpoint, to intentionally slow it down a little.
I'm thinking of simply adding a sleep call at the start of the controller action.
My reasoning is, a user who is genuinely trying to reset their password, probably won't be bothered by waiting an extra 5 seconds or so, to receive the confirmation that the password reset email has been sent. However this extra 5 seconds, I'm hoping could help slow down a bot.
One of my main reasons for wanting to do this, is because previously the reset function didn't give any indication if an invalid username was entered. This was to prevent malicious users from attempting to find valid usernames. I've been asked to change this though as users were finding it confusing.
As the reset function can now be used to determine if a username is valid, I wanted an extra level of security to help prevent malicious use.