Your code has precisely the timing attack he tried to describe in it. You're ret... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

nanofortnight on Dec 1, 2014 | parent | context | favorite | on: “Invalid username or password” is a useless securi...

Your code has precisely the timing attack he tried to describe in it. You're returning early when a user doesn't exist.

tracker1 on Dec 1, 2014 [–]

So? I'm advocating showing the correct error message... a timing attack is irrelevant in this case.

For that matter, adding a random 500-2000ms timer before returning a failed result would likely be as effective, and not lead to a bad user experience.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact