if12is

Ahmed Elsayed⚔️ |Software Engineering👨‍💻 | Fullstack developer 🪪|Backend (PHP-Laravel)| ASC 🦅- Citizens 🏅- Leoo 🐐

[if12is @if12is]

@HAGhoniem This is a crucial point that often gets overlooked in Apps. Implementing timebox helper or introducing a calculated delay to normalize response times is highly effective. However, balancing this with server resource management under high traffic is always a great engineering tip

[Hesham Ghoniem @HAGhoniem]

Your login page can tell attackers which email addresses have accounts without ever saying so.

Most teams know to show the same error message for every failed login. Fewer check the timing. Verifying a password is slow by design, often 100 to 300 milliseconds, to make cracking expensive. Paths that reject a login before the password check, like unknown, locked or unverified accounts, answer in a few milliseconds. With a script and a list of emails, that gap is easy to measure, and the result is a list of real accounts ready for phishing or password guessing.

The fix is to make every failure take the same time. Many frameworks offer a "timebox" helper that waits until a fixed duration has passed before responding. Wrap the whole login in it.

Two details matter. The fixed time must be longer than your slowest real path on production hardware, or the slow path still stands out. And it needs measuring after deployment, because a number that looks safe on a laptop may not be on a busy server.

#AppSec #CyberSecurity #SaaS #Authentication