When using sudo, su, or simply the login screen from Linux Mint Cinnamon or Debian with Cinnamon, they all hang for a second when you enter an incorrect password.For me, the fact that it hangs tells me it's incorrect already, making me Ctrl+C a sudo command and then retry with uparrow -> Enter, or close a login dialog with Escape and start typing to try again. This works just fine.It appears to be an attempt at rate limiting, but it does not work because an attacker can just setup parallel guesses. If it actually wanted to rate limit, it should limit how many queries can be inputted per time period, not how long it takes before the output is returned (and it's only delayed in the failure case, another dead giveaway).What is the reasoning behind doing it this way?
Why do login processes sleep before reporting password incorrect rather than limiting input?
login