Also if you are doing the username/password is incorrect you should also add an artificial delay if it's the username is wrong. Because you can tell which one is wrong my seeing how long it takes the server to respond.