5

Observed it many times on many Ubuntu versions. If you type wrong password either in UI mode or in terminal, it takes little more time before it declares incorrect password.

Correct password check is almost instantaneous, but incorrect password takes slightly longer. Its not lot of time, but still lot more than correct password.

Why is it so?

5

2 Answers 2

5

As Marc already mentioned, this mechanism should slow down automated password guesses.

Linux normally uses pam_unix as module to check passwords of local users. The default of this (and many other authentication modules) is to

[...] request a delay-on-failure of the order of two second.

as described in the man page of pam_unix (see parameter nodelay)

Consequently, an attacker is considerably slowed down (no more than 30 guesses per minute). Some implementations also increase the delay until the correct password is entered).

1

It's a security feature to prevent, or at least slow down, brute force or dictionary attempts to crack the password.

The difference in the delay between accepting a password and not accepting it may seam small if you are typing those passwords by hand. But, without this security feature an automated system could try thousands of passwords a second.

There is more detail in this question on stackoverflow: Why should checking a wrong password take longer than checking the right one?

Not the answer you're looking for? Browse other questions tagged .