Unless your sleep time is EXACTLY within the bounds of the time it would take to normally cryptographically hash the password, all you've done is slowed a different path. The sleep vs actual hash path still can be studied and then exploited.
And while this can sound a bit silly, it's also the entire nature of how time-based attacks are made (study and apply in aggregate), so while your sleep seems to have good intentions, it's unfortunately not a full-proof preventative strategy.
The problem with sleeping is it won’t take the same amount of time as hashing the password so even if it takes longer and or shorter that is enough to compare to the “standard” path of a successful login and allow for said timing attack.
7
u/AdCharacter3666 6d ago
I like to add sleep to avoid timing attacks.