15

Why does it take a long time for Windows 7 to show the failed login message when the wrong password is entered when it almost instantaneously lets you login if the password is correct?

Is it only me who is seeing this behavior?

4
  • What? can you rewrite your question please, it's difficult to understand.
    – Chopper3
    Nov 22, 2010 at 16:07
  • Sure, let me rephrase the question.
    – Biswanath
    Nov 22, 2010 at 16:08
  • Is this PC on a domain? Nov 22, 2010 at 16:12
  • I use the machine on and off the domain.
    – Biswanath
    Nov 22, 2010 at 16:13

5 Answers 5

10

It is mainly to prevent quick brute forcing of passwords.

This blog article gives you much more information than you probably care for!

2
  • Ben, I should learn more about my googling skills. Dropping off windows-7 from my query is giving me better results. Thanks for the link.
    – Biswanath
    Nov 22, 2010 at 16:19
  • 3
    The linked blog post is a good one, but I would summarize it differently from this answer. "It is mainly" because when you type a wrong password, the local workstation needs to contact the domain controller to make sure the password is really wrong (e.g. if your password had been changed from elsewhere, and your local password cache had not yet been refreshed). The deliberate delay, to prevent quick brute forcing, doesn't kick in until you've typed a wrong password multiple times.
    – LarsH
    Apr 22, 2014 at 3:09
4

So it takes longer to brute force a password.

If this computer is on a domain, using the right password will skip the domain lookup and verify against the cached credentials. If it can't use a cached credential then it has to contact a domain controller, which has several handshakes involved (Kerberos and LDAP at the minimum).

1
  • Me too became too imaginative thinking on the lines of may be to prevent remote timing attack.
    – Biswanath
    Nov 22, 2010 at 16:15
4

Most OSes (linux and windows are good examples) enforce a retry delay in order to prevent someone from scripting a login to the server and potentially brute forcing or locking out an account without a delay that will (potentially) allow the attempt to get noticed by someone getting failed login alerts. In addition the method of authentication (domain vs local) also has a performance hit on the authentication. Note that in the case of domain passwords the password is verified twice if it fails on a non pdc emulator DC.

4

It 's deliberate.

If you miss it 2 or 3 time, it stole less than a minute of your life. But if you try to much, it will take your life.

1
  • I have to vote this up as an explanation to scare users into putting some effort into typing their passwords correctly... Nov 22, 2010 at 16:30
3

I just did a test since I have a similar setup. My machine is Win 7 domain PC, if I am connected to the network my DC is on and enter the password wrong it takes 30 seconds or so to tell me the PW is incorrect. However if I turn my Wifi off or connect to a different network it instantly tells me the password is incorrect. Probably a mix of what Chris S said below and communication between the Domain controller and PC.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .