title: Preventing Timing Attacks
body: <p>It seems that <a href="http://en.wikipedia.org/wiki/Timing_attack#Examples" rel="noreferrer">for a while</a>, the login utility on Unix systems only calculated a hash when a valid username existed; this opened a security flaw which allowed for a timing attack, as the user could tell when a username was found by the amount of time it required to generate hashed key for comparison. </p>
  
  <p>This makes sense for desktop applications, but would it make sense for web applications too? I'd lean toward doing it, but is this kind of fix necessary? </p>
  
  <p>For example, in a Django auth module:</p>
  
  <pre><code>class MyBackend(ModelBackend):
  
      def authenticate(self, email=None, password=None):
          try:
              user = User.objects.get(email=email)
              return user if user.check_password(password) else None
          except User.DoesNotExist:
              User().check_password(password) # is this line necessary?
              return None
  </code></pre>
  
  <p>Would the additional hash computation make sense for this scenario? If I employ rate-limiting on auth calls, does this decrease the possibility of a timing attack like this? </p>