2

When logging in to my PC, and the password is correct, the login takes place nearly instantaneously. When the password is wrong, it takes a few seconds of waiting until the hint "The password is not correct." shows up.

The same thing happens on the terminal with sudo. But why?


I am pretty sure that the passwords hashes are saved and get compared to the hashes of entered passwords. But wouldn't it take longer to confirm the hashes are identical?

0

2 Answers 2

2

Password failures have an intentional delay introduced in a attempt to make password cracking a slow process. If a failure replied as quickly as a success, then a dictionary attack would finish in no time at all.

1

The PAM config has multiple services to check. When you get the password wrong, it has to check all of these services, which takes additional time - there may also be a deliberately added timeout on a failed check. When you get the password correct, it exits the stack as soon as it can with a successful result, so it doesn't necessarily have to check all of it's configured resources.

Not the answer you're looking for? Browse other questions tagged or ask your own question.