The system displays the following message when you attempt to log in with an incorrect username or an incorrect password:

Login incorrect
a. This message does not indicate whether your username, your password,
or both are invalid. Why does it not reveal this information?
b. Why does the system wait for a couple of seconds to respond after you
supply an incorrect username or password?

a. If the system were to say that a password someone entered was incorrect,
it would be confirming that the username was valid. This information
could be used by a cracker to help break into the system. Saying that a

password is valid for an invalid username does not make sense, but say-
ing that a password is valid on the system could also help a cracker.
b. The system pauses to slow down and thwart an automated password
cracking tool.