note 106690 deleted from function.sleep by thiago

Note Submitter: damian at-symbol-here emberlabs dot org ---- somewhat related to the previous notes about using sleep to help deter brute force attacks: Using sleep to deter brute forcing leads to another topic - a type of attack called a "timing attack" (which is what I believe barlow was referring to). There are actually several articles online that discuss this quirky type of vulnerability where an attacker can determine if an account exists, the accuracy of a password guess, etc. simply by the amount of time it takes for the site to provide a response. In some cases (one article mentioned one EC2 instance attacking a neighboring EC2 instance), the accuracy of the timing attack was honed down to a mere ~50 nanoseconds (after several thousand iterations). For scale, that's an accuracy of about 0.00000005 seconds. Quite scary. Adding a usleep() call with a random interval into the equation adds some pseudo-jitter (in place of the network jitter no longer present in many inter-datacenter attacks) to help throw off the accuracy of said attacks. Also, it's a good idea to run a junk password through your password hashing algorithm (you ARE using cryptographic hashing for passwords, aren't you?) even when the user's account doesn't exist, so that there is little difference in the time it takes to run the script when the account does or does not exist.