When logging in to my PC, and the password is correct, the login takes place nearly instantaneously. When the password is wrong, it takes a few seconds of waiting until the hint "The password is not correct." shows up.
The same thing happens on the terminal with sudo. But why?
I am pretty sure that the passwords hashes are saved and get compared to the hashes of entered passwords. But wouldn't it take longer to confirm the hashes are identical?
Password failures have an intentional delay introduced in a attempt to make password cracking a slow process. If a failure replied as quickly as a success, then a dictionary attack would finish in no time at all.
The PAM config has multiple services to check. When you get the password wrong, it has to check all of these services, which takes additional time - there may also be a deliberately added timeout on a failed check. When you get the password correct, it exits the stack as soon as it can with a successful result, so it doesn't necessarily have to check all of it's configured resources.
