It should not be possible to guess known accounts from the response time of a failed login

Current Situation

A login with an unknown account takes less time than a login with a known account.

Such disparities in response times for authentication attempts could allow attackers to guess valid user accounts. Armed with this knowledge they might subsequently launch brute-force attacks for credentials of valid accounts to achieve unauthorized access to JOC Cockpit.

Desired Behavior

Failed logins should enforce random delays.

• First and second failed login: delay between 1s and 3s
• Third and more failed logins: delay between 25s and 35s

A successful login resets the counting.