1

This question already has an answer here:

When logging in to my PC, and the password is correct, the login takes place nearly instantaneously. When the password is wrong, it takes a few seconds of waiting until the hint "The password is not correct." shows up.

The same thing happens on the terminal with sudo. But why?


I am pretty sure that the passwords hashes are saved and get compared to the hashes of entered passwords. But wouldn't it take longer to confirm the hashes are identical?

marked as duplicate by jw013, Ramesh, slm linux May 16 '14 at 15:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

Password failures have an intentional delay introduced in a attempt to make password cracking a slow process. If a failure replied as quickly as a success, then a dictionary attack would finish in no time at all.

1

The PAM config has multiple services to check. When you get the password wrong, it has to check all of these services, which takes additional time - there may also be a deliberately added timeout on a failed check. When you get the password correct, it exits the stack as soon as it can with a successful result, so it doesn't necessarily have to check all of it's configured resources.

Not the answer you're looking for? Browse other questions tagged or ask your own question.