Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Why would an incorrect password attempt take a lot longer to process than a correct one?

I noticed that when starting Windows and being prompted for a password, if you enter the right password it logs in right away, but if the entered credentials are wrong, you have to wait several seconds for a negative response.

This way I can tell if I mistyped long before the system gives me an answer, just by the amount of time I have to wait.

What's the reason for this behaviour?

My best guess would be that the system makes additional checks for the account data on different locations (network?) if no matching login data was found.

share|improve this question

marked as duplicate by slhck, Mehper C. Palavuzlar, ChrisF, RedGrittyBrick, Simon Sheehan Nov 10 '11 at 0:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 6 down vote accepted

To slow down the rate at which you can guess wrong passwords.

By default this is Windows only protection from you brute forcing the password.

share|improve this answer

If your computer is a member of a domain, it caches your login credentials' hash locally, so you can log in when the domain server is not available (or your laptop is away from office, etc.) However, if the entered password does not match the stored hash, your computer must consult the domain server, since your password may have been changed elsewhere (on another computer).

There is an excellent blog post by Raimond Chen that discusses this issue. He also says that:

Another reason why invalid passwords take longer to reject is to reduce the effectiveness of dictionary attacks. If invalid passwords were rejected just as quickly as valid passwords were accepted, then a bad guy could just churn through a dictionary trying out invalid passwords at high speed.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged .