3 ms·
As others have said, for properly hashed passwords, the answer is no. However, for plaintext passwords using the default string comparison routines, a timing a
by kej 9y ago
As others have said, for properly hashed passwords, the answer is no.
However, for plaintext passwords using the default string comparison routines, a timing attack becomes possible since it will take slightly longer to compare a partially right password than a completely wrong password. The timing discrepancies would give the attacker clues about how close he is to succeeding.