What would be wrong with the username/password checker where the response is instantaneous for valid attempts but a pre-built time delay (say 1 sec) is used for unsuccessful ones? It would not slow down legitimate users, but would obviate the need for key derivation functions, and thwart the timing attacks. Can someone critique please?
-
Using a timing attack I could most likely enumerate your username(s) in case they're email addresses. If you have a password reset mechanism with the same "feature", I could enumerate your usernames for sure!– JeroenAug 13, 2019 at 17:09
-
security.stackexchange.com/questions/94432/… and security.stackexchange.com/questions/85435/… and security.stackexchange.com/questions/958/…– schroeder ♦Aug 13, 2019 at 17:15
Add a comment
|