為什麼計算機響應錯誤的密碼比響應正確的密碼需要更長的時間？

您是否曾在計算機上意外輸入錯誤的密碼，並注意到與輸入正確的密碼相比，需要幾分鐘才能做出響應？為什麼？今天的超級使用者問答帖子回答了一位好奇的讀者的問題。...

您是否曾在計算機上意外輸入錯誤的密碼，並注意到與輸入正確的密碼相比，需要幾分鐘才能做出響應？為什麼？今天的超級使用者問答帖子回答了一位好奇的讀者的問題。

今天的問答環節是由SuperUser提供的，SuperUser是Stack Exchange的一個分支，是一個由社群驅動的問答網站分組。

螢幕截圖由sully213（Flickr）提供。

問題

超級使用者閱讀器user3536548想知道為什麼輸入錯誤密碼時響應時間更長：

When you enter a password and it is correct, the resp***e time is practically instantaneous. But when you enter an incorrect password (by accident or having forgotten the correct one), it takes a while (10-30 seconds) before it responds that the password is incorrect.

Why does it take so long (relatively) to say that the password is incorrect? This has always bugged me when entering incorrect passwords on Windows and Linux systems (regular and VM-based). I am not sure about Mac OSX since I cannot remember if it is the same (it has been a while since I last used a Mac).

I am asking in the context of a user logging in to the system physically on location rather than through SSH which could conceivably use somewhat different mechani**s to log in (validate credentials).

為什麼輸入錯誤的密碼會有較長的響應時間？

答案

超級使用者貢獻者Michael Kjorling為我們提供了答案：

Why does it take so long (relatively) to say that the password is incorrect?

It does not. Or rather, it does not take the computer any longer to determine that your password is incorrect compared to it being correct. The work involved for the computer is, ideally, exactly the same. Any password verification scheme that takes a different amount of time based on whether the password is correct or incorrect can be exploited to gain knowledge, however **all, of the password in less time than would otherwise be the case.

The delay is an artificial delay to make repeatedly trying to gain access by using different passwords infeasible, even if you have some idea of what the password is and automatic account lockout is disabled (which it should be in most scenarios as it would otherwise allow for a trivial denial of service against an arbitrary account).

The general term for this behavior is tarpitting. While the Wikipedia article talks more about network service tarpitting, the concept is generic. The Old New Thing is not an official source either, but the article “Why does it take longer to reject an invalid password than to accept a valid one?” does talk about this (near the end of the article).

有什麼要補充的解釋嗎？在評論中發出聲音。想從其他精通技術的Stack Exchange使用者那裡瞭解更多答案嗎？在這裡檢視完整的討論主題。