1

When I enter the right password to log in to my computer*, I am in instantly. However, if I mistype it, there is around a 2 second pause. Are there significantly more computations taking place to check if a password is incorrect than incorrect?

* (MacBook Air 2015 if it matters)

Improve this question
3
  • 3
    (Whatever the camera "sees" needs to be transferred to local authorities. Next, a wagonload of alphabet soup information skimmers need to be fed. Finally, Santa needs to be alerted that someone may have been naughty :) – greybeard Dec 18 '20 at 7:05
  • 1
    It also has to erase the stars in the password field. It doesn't have to do that if the password is correct. – Pål GD Dec 18 '20 at 9:00
  • Perhaps it also keeps a log on unsuccessful login attemps. – rus9384 Dec 18 '20 at 13:48
3

This is not really much of a computer science question, more a user interface design and/or infosec question.

Are there significantly more computations taking place to check if a password is incorrect than incorrect?

Since there is no third possibility, checking if a password is incorrect and checking if a password is correct, are the same thing. If it is not correct, then it is incorrect, if it is not incorrect, then it is correct.

However, if I mistype it, there is around a 2 second pause.

The user interface design reason for this is to give you time to think about your password. Also, it accounts for the "cat walking across keyboard" case.

The infosec reason is to slow down brute force attacks. A legitimate user who accidentally mistypes their password will only lose 2 seconds re-typing it again. An attacker running a brute force attack who needs to try out trillions of passwords automatically, will be severely slowed down.

The legitimate user will be slowed down from being able to type their passwords about once per second to about once every 3 seconds. The attacker will be slowed down from being able to try thousands of passwords per second to once every 2 seconds.

Typically, the wait time is even made to increase with every wrong try, up to a maximum. Sometimes, there is also a maximum number of wrong tries after which additional measures need to be taken to gain back access to the account, although such a measure is slightly dangerous, since it can easily be abused for a denial of service attack if not designed carefully.

Improve this answer
3
  • Sometimes this happens in windows 10, but the lag does not seem to be fixed. It can be 1 second or can be 30 seconds. As if it really is doing something. – rus9384 Dec 18 '20 at 10:33
  • 1
    It's not entirely correct that checking correctness necessarily is the same as checking incorrectness. This is where timing attacks come in to play. Suppose that your authorization algorithm needs a "nonce" (an integer between 1 and 1000) such that sha(pwd+nonce) == key. In this setting, checking correctness halts when the nonce is found, but incorrectness needs to check all possible values for the nonce. – Pål GD Dec 18 '20 at 15:18
  • You might have a system where a correct password needs to pass ten checks - incorrect passwords could fail the first check and be detected much quicker, the opposite of what is observed. Or you might have a system where a correct password needs to pass any one of ten checks - incorrect password would have to examine all checks and would often take longer to fail. – gnasher729 Dec 19 '20 at 0:17
0

I think (but I cannot be sure) that this happens because the software deliberately waits on incorrect passwords, much longer than it takes to actually detect that the password is incorrect. This may be done to slow down someone who uses a computer to enter passwords, to the point where they can only check 20 or 30 passwords per minute.

Another possibility: It may be possible for an attacker to get information about the correct password by entering wrong passwords and measuring how long it takes until they fail. To prevent this, the system reports incorrect passwords always after exactly the same time. (This is not necessary for correct passwords, because there the attacker will be told they have the correct password). The time until an incorrect password is reported must be at least as long as the longest time it takes to check any incorrect password, which might be quite long.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy