On linux whenever I provide the wrong password, I have to wait 3 seconds. I find this quite annoying and prefer the windows default: no delay until the fifth fail, then it delays for 15 seconds or something like that.

Is there a way to set the nodelay option in pam_unix but do enable a delay every 5 failed attempts?

Moreover, sometimes I have CAPSLOCK turned on. It would be nice if the authenticator either (1) notices this and inverts the capitalization, or (2) login if either the actual or the inverted capitalization matches the password.

Effectively both increase the password search space: Longer passwords are more reasonable to have since the higher chance to mistype a longer password is less annoying if CAPSLOCK-errors are not a problem and the expected waiting is also reduced.

  • 1
    You are not going to find a security minded OS that implements your CAPSLOCK idea. At most, an OS with a physical connection to your keyboard will warn that you've left CAPSLOCK on and leave you to figure it out, which is what Windows does. There is near universal acceptance in software design that re-interpreting the password supplied by the user is a bad idea. (and people rarely agree on these things!) – Andrew B Jan 11 '16 at 16:47
  • Could you argument why it is a bad idea to interpreter a password in two ways? I can imagine that for a brute force attack a 2 times decrease in search space is not that much, especially if you consider that adding one character to a password is less of an inconvenience (let's face it, inconvenience is the greatest enemy of strong passwords) when the chance of error inputting decreases so significantly. – Herbert Jan 13 '16 at 20:30
  • Plus you can implement your authenticator such that the second interpretation is only applied when the password has the minimal length at which this decrease in search space is irrelevant anyway. To restate, a security minded OS should consider convenience as well, low convenience leads to bad passwords. IMHO it's a trade-off, not a race to one side. – Herbert Jan 13 '16 at 20:32
  • I respect the offer to discuss the theory, and mean no disrespect when I say that I don't wish to invest significant time in it. To me it's fairly self-evident in current implementation: no OS I know of does this, no PAM module in popular use provides an option for it, it betrays the expectations of the lower level security model...etc. – Andrew B Jan 13 '16 at 20:39
  • Hi Andrew, that's fair. The most important feedback is that it does not exist, and it doesn't really surprise me. Nevertheless, I think the arguments you raise optimize in theoretical security for a fixed password size, not for the expected password size decided upon by a human given that model. – Herbert Jan 13 '16 at 20:46

There's a nodelay option right in the pam_unix man page. It sounds promising for eliminating the delay on every attempt. I don't think you can delay on every 5th attempt, but the standard practice is to lockout after 3-5 attempts anyway. You'd have to accomplish this with something like pam_faillock or pam_tally2.

       This argument can be used to discourage the authentication component from requesting a delay should the
       authentication as a whole fail. The default action is for the module to request a delay-on-failure of
       the order of two second.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.