Timing attack: Easy to figure out whether a user exists or not

[untitaker]

• Login with valid username and invalid password: Long response time
• Login with invalid username: Short response time

https://cryptocoding.net/index.php/Coding_rules#Avoid_branchings_controlled_by_secret_data

The question is, do we care?

[untitaker]

I've deleted previous comment, the test was sending malformed form data that was immediately rejected during parsing. The timing difference is very obvious when using:

ab -n 1000 -p form -m POST -T 'application/x-www-form-urlencoded' -H 'Referer: http://localhost:6767/login/' http://localhost:6767/login/

With the form file containing either:

• user=asdf&pass=asdf (nonexisting user)
• user=demo&pass=asdf (existing user)