Why Incorrect Passwords Slow Down Your Computer

Why Incorrect Password Attempts Take Longer

Have you observed a slight delay when attempting to log in with an incorrect password, compared to the near-instantaneous response of a correct one? This phenomenon is a common experience for many computer users.

The reason for this difference lies in how modern operating systems and security protocols are designed to protect against brute-force attacks.

Understanding the Security Mechanism

When you enter a password, the system doesn't immediately verify it against the stored hash. Instead, a deliberate delay is introduced when an incorrect attempt is made.

This intentional slowing down is a security measure. It makes it significantly more difficult for attackers to rapidly guess passwords through automated means.

How it Works: Hashing and Delay

Passwords are not stored in plain text. They are converted into a hash, a one-way function that transforms the password into a seemingly random string of characters.

When you enter a password, it's also hashed and compared to the stored hash. If the hashes don't match, the delay is triggered.

The Role of Brute-Force Protection

Without this delay, an attacker could try millions of passwords per second. The delay, even if only a fraction of a second, dramatically increases the time required for a successful brute-force attack.

This makes such attacks impractical and less likely to succeed.

SuperUser Q&A Source

Today’s explanation originates from a question posed and answered on SuperUser, a question-and-answer website that is part of the Stack Exchange network.

SuperUser provides a platform for users to collaboratively address technical computing questions.

Image credit: sully213 (Flickr).

Understanding Password Verification Delays

A SuperUser user, identified as user3536548, has raised a pertinent question regarding the noticeable delay experienced when submitting an incorrect password. The user observes a near-instantaneous response with a correct password, contrasted by a significant wait – typically 10 to 30 seconds – when an incorrect one is provided.

The Core of the Issue

The question centers around the reason for this latency in informing the user of an incorrect password attempt. This behavior has been consistently observed across various operating systems, including Windows and Linux, both on physical machines and within virtual machine environments.

Why the Delay?

The extended response time isn't due to simply checking if the password matches. Instead, it's a security measure designed to thwart certain types of attacks.

• Brute-Force Attack Mitigation: A common attack involves systematically trying numerous password combinations.
• Timing Attacks: Without a delay, an attacker could potentially deduce information about the correct password by measuring the time it takes for the system to respond to each guess.

By intentionally introducing a delay when an incorrect password is entered, the system makes it significantly more difficult and time-consuming for attackers to carry out these types of malicious activities.

How it Works

The system doesn't immediately verify the password against the stored hash. It deliberately pauses for a set duration. This pause is consistent regardless of the incorrect password entered.

This consistent delay obscures the timing differences that could reveal information about the password's correctness. It effectively levels the playing field, making each attempt take roughly the same amount of time.

Context of Local Logins

The user specifically inquired about physical, on-location logins, distinguishing them from SSH connections. This distinction is important because SSH may employ different authentication mechanisms. The described delay is generally applicable to direct console logins.

Therefore, the observed delay is a deliberate security feature, not a flaw, intended to protect against password-based attacks. It's a standard practice implemented across multiple operating systems to enhance system security.

Understanding Password Verification Delays

A SuperUser community member, Michael Kjorling, provides insight into why incorrect password attempts often seem to take a noticeable amount of time to process.

The Core Principle: Consistent Processing Time

The perceived delay isn't due to the computer needing more time to determine the password is wrong. Ideally, the computational effort required for verification remains constant, regardless of password validity.

Any password verification system exhibiting variable timing based on correctness is vulnerable. Such a system could inadvertently reveal information about the password, potentially speeding up unauthorized access.

The Purpose of Artificial Delay

The delay you experience is intentionally introduced. It's designed to hinder brute-force attacks, where numerous password guesses are systematically attempted.

This artificial delay makes repeated attempts to gain access impractical, even if an attacker possesses partial knowledge of the password or if automatic account lockout mechanisms are disabled – a common practice to avoid denial-of-service vulnerabilities.

Tarpitting: A Common Security Technique

This behavior is broadly known as tarpitting. While often discussed in the context of network services, the principle applies universally to security protocols.

Although not an official resource, the blog "The Old New Thing" addresses this topic in the article "Why does it take longer to reject an invalid password than to accept a valid one?".

Further Discussion

Do you have additional perspectives on this explanation? Share your thoughts in the comments section below.

For a more comprehensive discussion and insights from other technical experts, explore the original conversation thread on Stack Exchange here.