Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Out of curiosity, why it takes way much time for windows 7 to show the failed login message for the wrong password instead it almost instantaneously lets you to login if the password is correct ?

Is this only me who is seeing this behavior ?

share|improve this question
    
What? can you rewrite your question please, it's difficult to understand. –  Chopper3 Nov 22 '10 at 16:07
    
Sure, let me rephrase the question. –  Biswanath Nov 22 '10 at 16:08
    
Is this PC on a domain? –  Kyle Nov 22 '10 at 16:12
    
I use the machine on and off the domain. –  Biswanath Nov 22 '10 at 16:13

5 Answers 5

up vote 7 down vote accepted

It is mainly to prevent quick brute forcing of passwords.

This blog article gives you much more information than you probably care for!

share|improve this answer
    
Ben, I should learn more about my googling skills. Dropping off windows-7 from my query is giving me better results. Thanks for the link. –  Biswanath Nov 22 '10 at 16:19
1  
The linked blog post is a good one, but I would summarize it differently from this answer. "It is mainly" because when you type a wrong password, the local workstation needs to contact the domain controller to make sure the password is really wrong (e.g. if your password had been changed from elsewhere, and your local password cache had not yet been refreshed). The deliberate delay, to prevent quick brute forcing, doesn't kick in until you've typed a wrong password multiple times. –  LarsH Apr 22 at 3:09

So it takes longer to brute force a password.

If this computer is on a domain, using the right password will skip the domain lookup and verify against the cached credentials. If it can't use a cached credential then it has to contact a domain controller, which has several handshakes involved (Kerberos and LDAP at the minimum).

share|improve this answer
    
Me too became too imaginative thinking on the lines of may be to prevent remote timing attack. –  Biswanath Nov 22 '10 at 16:15

I just did a test since I have a similar setup. My machine is Win 7 domain PC, if I am connected to the network my DC is on and enter the password wrong it takes 30 seconds or so to tell me the PW is incorrect. However if I turn my Wifi off or connect to a different network it instantly tells me the password is incorrect. Probably a mix of what Chris S said below and communication between the Domain controller and PC.

share|improve this answer

Most OSes (linux and windows are good examples) enforce a retry delay in order to prevent someone from scripting a login to the server and potentially brute forcing or locking out an account without a delay that will (potentially) allow the attempt to get noticed by someone getting failed login alerts. In addition the method of authentication (domain vs local) also has a performance hit on the authentication. Note that in the case of domain passwords the password is verified twice if it fails on a non pdc emulator DC.

share|improve this answer

It 's deliberate.

If you miss it 2 or 3 time, it stole less than a minute of your life. But if you try to much, it will take your life.

share|improve this answer
    
I have to vote this up as an explanation to scare users into putting some effort into typing their passwords correctly... –  Bart Silverstrim Nov 22 '10 at 16:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.