Web Security · Senior · Question 39 of 75
Why should login and password reset responses take about the same time for existing and unknown accounts?
- 1Because slow responses improve SEO
- ✓Correct answer: Timing differences reveal which accounts exist, even if the messages are identical
- 3Because browsers time out unequal requests
Explanation
Hashing a password only for real users makes those requests slower. Run equivalent work or respond asynchronously.