al timing differences, and determine which
users are &quot;good&quot; and which are &quot;bad&quot;.  From there,
a determined attacker can focus their attention on the known good usernames.
Note that the timings will vary depending on server load, number of
users in the user base, type of storage of user data (<i>e.g.</i>
LDAP directories, SQL tables, RADIUS servers, flat files, <i>etc</i>).

<p>
The <code>mod_delay</code> module attempts to prevent such timing differences
by keeping track of the time take