10

When you enter a password and it's correct the response is practically instantaneous (i.e. the log on process).

When you enter an incorrect password (accidently, forgotten, etc) however, it takes a while (10-30 seconds) before it responds that the password was incorrect.

Why does it take so long (relatively) to say "incorrect password"?

This has always bugged me about entering incorrect passwords on Windows and linux (real and VM); I'm not sure about mac OSX as I can't remember if it's the same, been awhile since I last used a mac.

EDIT: for the sake of duplication, I'm asking in the context of a user logging on to the system at the physical computer rather than through ssh which could conceivably use somewhat different mechanisms to log in/validate credentials.

4
  • The reasons are the exactly same ones compared to the duplicate (SSH login).
    – Jens Erat
    May 18, 2015 at 14:16
  • They aren't, context is different; the other difference is that the answer's provided aren't as detailed
    – Thermatix
    May 18, 2015 at 14:22
  • I agree with the OP. The questions are certainly related, but not the same. An answer to "why does it take so long for SSH to say 'invalid password' on a remote connection?" is not necessarily the same as an answer to "why does it take so long for Windows login to say 'invalid password' when I am at the console?", although they are likely to be similar. Definitely related, doubtfully duplicates.
    – user
    May 19, 2015 at 7:13
  • For posterity, just in case this gets reopened, the supposed duplicate is Why would an incorrect password attempt take a lot longer to process than a correct one?, but note that beyond the title, the only specific example given there is a remote SSH connection to a Linux host.
    – user
    May 19, 2015 at 7:15

1 Answer 1

18

Why does it take so long (relatively) to say "incorrect password" ?

It doesn't. Or rather, it doesn't take the computer any longer to determine that your password is incorrect compared to it being correct. The work involved for the computer is, ideally, exactly the same. (Any password verification scheme that takes a different amount of time based on whether the password is correct or incorrect can be exploited to gain knowledge, however small, of the password in less time than would otherwise be the case.)

The delay is an artificial delay to make repeatedly trying to gain access by using different passwords infeasible, even if you have some idea of what the password likely is and automatic account lockout is disabled (which it should be in most scenarios, as it would otherwise allow for a trivial denial of service against an arbitrary account).

The general term for this behavior is tarpitting. While the Wikipedia article talks more about network service tarpitting, the concept is generic. The Old New Thing isn't an official source either, but Why does it take longer to reject an invalid password than to accept a valid one? does talk about this near the end of the article.

9
  • I've been wondering this too! Interesting response. I wish they could make the delay a bit shorter though, as it is annoying to wait that long when you realize right after pressing enter that it's wrong :P
    – Blaine
    May 18, 2015 at 12:13
  • 1
    This protection is largely target at scripts and automated brute force techniques rather than interactive logins. There are a few reasons you cannot adjust the time, including that in many cases, the delay is random (on the order of milliseconds). there are a set of attacks of cryptography referred to as Timing Analysis, which attempts to gain knowledge of a cryptographic key based on how long it took to produce an error message. a random delay defeats that nicely. May 18, 2015 at 12:34
  • @FrankThomas I'll readily concede that I didn't state the means by which the repeated attempts were being made. That said, there is a very real and noticable delay in many security systems upon providing invalid credentials, preventing further attempts for some brief but human-perceptable amount of time. Since at that point you're already accessing the system interactively, microsecond or millisecond level timing attacks on the cryptographic primitives do not really apply.
    – user
    May 18, 2015 at 12:38
  • Is this authoritative? Do you have an article or something to reference?
    – rfportilla
    May 18, 2015 at 13:57
  • @rfportilla "Authoritative"? No. OP is asking about two or three completely different operating systems, for a start, one of which can have any number of system-level applications (login manager, screensaver, ...) prompting for passwords, and the other two being proprietary (so we don't know their inner workings). It isn't possible to provide an authoritative source covering all of that. If the question had been "why does gdm3 do it this way?" then an actually authoritative answer might have been possible, but that is not the case here.
    – user
    May 18, 2015 at 14:00

Not the answer you're looking for? Browse other questions tagged .