2 added 8 characters in body
source | link

You should not optimise testing passwords, quite the reverse. If you get the password wrong a small time penalty is no bad thing, since it slows down the rate at which you can try out passwords. Some unix systems will pause for a few seconds after you get your login password wrong to slow down any brute force attack.

The other reason not to do client side checking is that you want the server to know if people are getting the password wrong. That lets you log failures and warn the legitimate user that someone tried to get into their account. If you do client side checking you lose some of that valuable information.

You should not optimise testing passwords, quite the reverse. If you get the password wrong a small time penalty is no bad thing, since it slows down the rate at which you can try out passwords. Some unix systems will pause for a few seconds after you get your login password wrong to slow down any brute force attack.

The other reason not to do client side checking is that you want the server to know if people are getting the password wrong. That lets you log failures and warn the legitimate user that someone tried to get into their account. If you do client side checking you lose that valuable information.

You should not optimise testing passwords, quite the reverse. If you get the password wrong a small time penalty is no bad thing, since it slows down the rate at which you can try out passwords. Some unix systems will pause for a few seconds after you get your login password wrong to slow down any brute force attack.

The other reason not to do client side checking is that you want the server to know if people are getting the password wrong. That lets you log failures and warn the legitimate user that someone tried to get into their account. If you do client side checking you lose some of that valuable information.

1
source | link

You should not optimise testing passwords, quite the reverse. If you get the password wrong a small time penalty is no bad thing, since it slows down the rate at which you can try out passwords. Some unix systems will pause for a few seconds after you get your login password wrong to slow down any brute force attack.

The other reason not to do client side checking is that you want the server to know if people are getting the password wrong. That lets you log failures and warn the legitimate user that someone tried to get into their account. If you do client side checking you lose that valuable information.