How many times would an attacker have to enter the same password when doing a string comparison timing attack? I assume it would have to be at least a few dozen times to average out network lag, for example. If the number is significantly more than the number a normal user would enter, is checking the number of times a person enters a password an effective way to combat string comparison timing attacks? For example, if the tries of the same password exceeds 100 then require a CAPTCHA? Is this more resource efficient than simply checking the whole password?

1 Answer 1


You should already be rate-limiting login attempts after a few requests (temporary lockout, CAPTCHA, Clippy popping up and berating you, etc.). This is a common way to stop brute-force attacks, and it will also seriously cripple those trying to do timing attacks.


Also, if you're hashing passwords and looking them up in a database, timing attacks shouldn't be very relevant. The attacker would have to be able to produce arbitrary hashes to gradually "home in" on the right one. This is very difficult!

Timing attacks will be more relevant for things like session cookies

  • So how many times would an attack have to enter the same password to average out network lag? (Question out of curiosity)
    – APCoding
    Jul 22, 2015 at 14:49
  • I would guess around 100 or so?
    – APCoding
    Jul 22, 2015 at 14:54
  • This article from 2009 suggests you need thousands of samples (one trial group used 27,000 samples, and others ranged from 13,000 to 68,000 samples). It probably depends on network and hardware quality quite a bit, as well as how accurate you need the results to actually be. Jul 22, 2015 at 14:54
  • 2
    Also, if you're hashing passwords and looking them up in a database which is not very likely when using salt (and everyone does that, right?).
    – Cthulhu
    Jul 22, 2015 at 15:01
  • 1
    Hashing passwords with salt, pepper, olive oil, and garlic, yes :D Jul 22, 2015 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .