13

I type my password to login to Win or Linux.

Case 1: I get it right. Almost instant reaction.

Case 2: I misspelled it. It takes a while, and then rebounds.

Why does it takes longer to identify a wrong password vs a correct one? shouldn't the time to identify be the same?

Improve this question
3
23

It takes the same time to verify a wrong password and a correct one. But, when the password is wrong, the operating system makes you wait a bit. This is a security feature, to discourage people who try "potential passwords" (in particular people with some electronic skills, plugging in some circuitry which the computer will consider to be a keyboard, but which in reality tries a lot of passwords real fast).

Such things don't work as well in a network context (if the attacker wants to try 100 passwords quickly, he can open 100 connections in parallel) but the password verification code is often shared between network and local logon.

Improve this answer
14

When you enter incorrect credentials, the operating system connects to the domain controller (for Windows or the equivalent for other operating systems) to see whether your credentials have changed (e.g. a password reset by the admin, locked out from failed authentication attempts on another DC). This may take a few more seconds, particularly if the DC is busy or remote.

This is separate from an added delay. Windows, for example, will add an increasingly large delay after the third and subsequent failed login attempt in case the user is attempting to guess a user name rather than just a password.

Improve this answer
2
  • 1
    Are you saying that if the credentials have recently changed on the domain controller so that a particular password is now wrong, then it might still be accepted? (That appears to follow from your explanation about domain controllers--you appear to be saying that credentials are cached locally and, at least some of the time, only updated or checked when a username/password combination appears wrong.) – Eliah Kagan Mar 23 '13 at 12:15
  • 1
    @EliahKagan See blogs.msdn.com/b/oldnewthing/archive/2010/03/23/9983312.aspx for a better explanation. In short, yes this may occur although the window of opportunity is very small. – akton Mar 23 '13 at 21:46
4

Identify yes, but you have to then check the policy for lockout, get/update the recent bad attempts from the domain, log the security events etc.

Also, some systems just add a delay to slow down someone from trying usernames dictionaries and such.

Improve this answer
4

It's likely a security thing. If a bad guy could try thousands of passwords as fast as they could type (or automate!), they could break in fairly quickly. If each failure costs them several seconds, the system becomes orders of magnitude harder to attack with brute force.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.