Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a wrong password vs a correct one? shouldn't the time to identify be the same?
It takes the same time to verify a wrong password and a correct one. But, when the password is wrong, the operating system makes you wait a bit. This is a security feature, to discourage people who try "potential passwords" (in particular people with some electronic skills, plugging in some circuitry which the computer will consider to be a keyboard, but which in reality tries a lot of passwords real fast).
Such things don't work as well in a network context (if the attacker wants to try 100 passwords quickly, he can open 100 connections in parallel) but the password verification code is often shared between network and local logon.
When you enter incorrect credentials, the operating system connects to the domain controller (for Windows or the equivalent for other operating systems) to see whether your credentials have changed (e.g. a password reset by the admin, locked out from failed authentication attempts on another DC). This may take a few more seconds, particularly if the DC is busy or remote.
This is separate from an added delay. Windows, for example, will add an increasingly large delay after the third and subsequent failed login attempt in case the user is attempting to guess a user name rather than just a password.
Identify yes, but you have to then check the policy for lockout, get/update the recent bad attempts from the domain, log the security events etc.
Also, some systems just add a delay to slow down someone from trying usernames dictionaries and such.
It's likely a security thing. If a bad guy could try thousands of passwords as fast as they could type (or automate!), they could break in fairly quickly. If each failure costs them several seconds, the system becomes orders of magnitude harder to attack with brute force.
