What you are describing is a brute force attack. If a hacker can determine a mechanism that allows for rapid testing of passwords, it is a thing. This is usually scripted and automated and many times are deployed by what are called script kiddies who just brute force attack everything they can find. The other type are the hackers who have a target in mind and spend some time to determine the best way to attack a system … whether it’s via brute force or finding another more efficient way such as phishing for information.
What we see today, on many logins whether websites or local system, are 'you have exceeded the maximum number of attempts. Please try again later". That is an example countermeasure against brute force hacking passwords. Two factor is also another.
However, hackers are sometimes able to find backdoor APIs that do not rate limit the ‘tests’. As such, they are able to test a large number of generated passwords in a short period of time.
Again, talking brute force attacks, this is where set entropy comes into play. Part of the xkcd comic above. The longer and more diverse a password, the larger the number of possible combinations, leading to a longer time to randomly discover the password. Diverse meaning utilizing a large set of tokens such as lower case characters, uppercase characters, numbers, special characters. The more characters and the more diversity in the tokens, the larger the entropy.
To take advantage of the entropy, the password much also utilize somewhat random selection of tokens out of the set of possible characters. For instance, twenty 'a’s in a row does not properly utilize the available entropy.
When they brute force attack a password, the tools are looking for a response that differs from the failed case. This indicates success. Or, if they know the system that they are attacked, they know what indicates success. In your example where nothing is returned, it timesout and continues on to the next attempt.
Brute force is generally the last method that will be utilized by a motivated attacker since it is inefficient and can take a very long time to discover the password unless the password has small entropy. Depending on how the password was generated and utilized, this can be considered a one-time pad. Surprisingly simple but the one time pad can be difficult to hack unless …
The first order of business for a hacker is to reduce the possible entropy. This may be by having other types of knowledge about the target. Or perhaps doing an attack by using a list of commonly used phrases, for instance. Or even easier, pulling the lists of previously hacked password / user combinations and then applying them to other sites … inevitably they’ll find a winner every now and then.
As far as rate limiting, another brute force attack example is on encrypted files. Such as PDF. There really is no rate limiting there and applying a high compute capable machine (e.g. with CUDA) a very high rate of tests can be performed in a relatively short period of time. 10’s of thousand tests per seconds. Add more compute and scale the rate.
They do, to an extent. IP blocking is an example. Rate limiting is another. Many different behind the scenes things are going on to improve security. However, obtrusiveness and usability are also key factors. If, for instance, everyone was required to adhere to completely random jibberish passwords, 20 digits in length, must be changed each thirty days … what will the user do. They’ll write it down on a piece of paper because they won’t be able to remember them. That violates key security fundamentals.
Hence:
Security is not easy. It doesn’t take much to compromise it from human factors to software bugs. Layered protection (ring fence) is the best way to overcome such challenges.
