Why does the login check take longer if the password is wrong? [closed]

Question

Possible Duplicate:
Why would an incorrect password attempt take a lot longer to process than a correct one?

I noticed that when starting Windows and being prompted for a password, if you enter the right password it logs in right away, but if the entered credentials are wrong, you have to wait several seconds for a negative response.

This way I can tell if I mistyped long before the system gives me an answer, just by the amount of time I have to wait.

What's the reason for this behaviour?

My best guess would be that the system makes additional checks for the account data on different locations (network?) if no matching login data was found.

Answer 1

To slow down the rate at which you can guess wrong passwords.

By default this is Windows only protection from you brute forcing the password.

Answer 2

If your computer is a member of a domain, it caches your login credentials' hash locally, so you can log in when the domain server is not available (or your laptop is away from office, etc.) However, if the entered password does not match the stored hash, your computer must consult the domain server, since your password may have been changed elsewhere (on another computer).

There is an excellent blog post by Raimond Chen that discusses this issue. He also says that:

Another reason why invalid passwords take longer to reject is to reduce the effectiveness of dictionary attacks. If invalid passwords were rejected just as quickly as valid passwords were accepted, then a bad guy could just churn through a dictionary trying out invalid passwords at high speed.