As far as I understand the process of logging someone into your system goes like this:
1) The user which wants access transmits credentials to your system (typically
login - being a unique identifier - and
2) The system uses the
login to retrieve the account information from a database comprising a passwordhash to compare against.
3) If a user was found, the transmitted password is hashed and the hash is compared against the hashed password from the DB.
4a) If both match access is granted
4b) If both do not match access is declined
Whereby the process of (2) leaks the information of a
login existing in your system or not (via time).
My question is twofold:
a) Is this risk of leaking the information worth mitigating?
and more interesting:
b) How to mitigate that risk?