A computer implemented method for efficiently authenticating users while preventing enumeration attacks, the method being performed by an authentication system, including a client computer system and an authentication server system, the authentication server system including at least one processor and a memory, the method being for use in a computer networking environment including a plurality of computing systems, the method comprising: an act of receiving, by the authentication server system, user login credentials from a user of the client computer system, the user login credentials including a user identifier and a password; an act of making at least one of the following determinations, by the authentication server system: determining that the user identifier does not match any existing user account; determining that the user identifier matches at least one existing user account, but the user's account is in a locked state; and determining that the user identifier matches at least one existing user account, but the user's password does not match the user identifier; an act of generating and applying a delay to a response message to the user of the client computer system to ensure that the response message is sent to the user after the same amount of time has elapsed since the user's login credentials were received, wherein the length of the delay is variable and is dynamically generated for each login attempt, and an act of returning, by the authentication server system, to the user of the client computer system the same response message regardless of which determination is made, the response message indicating that the user's login credentials are invalid, wherein the response message prevents the user from determining which of the credentials was invalid, as the response message is the same for each determination and is sent to the user after a measured response time that is the same for each determination; wherein the response messages are stored at the authentication server system without storing state information for user names or other identifiers that do not match existing user accounts, wherein a cookie is created on the client computer system to track one or more portions of information associated with the user's login attempts and wherein at least one of the portions of information associated with the user's login attempts comprises a failed login attempt counter. determining that the user identifier does not match any existing user account; determining that the user identifier matches at least one existing user account, but the user's account is in a locked state; and determining that the user identifier matches at least one existing user account, but the user's password does not match the user identifier; an act of generating and applying a delay to a response message to the user of the client computer system to ensure that the response message is sent to the user after the same amount of time has elapsed since the user's login credentials were received, wherein the length of the delay is variable and is dynamically generated for each login attempt, and an act of returning, by the authentication server system, to the user of the client computer system the same response message regardless of which determination is made, the response message indicating that the user's login credentials are invalid, wherein the response message prevents the user from determining which of the credentials was invalid, as the response message is the same for each determination and is sent to the user after a measured response time that is the same for each determination; wherein the response messages are stored at the authentication server system without storing state information for user names or other identifiers that do not match existing user accounts, wherein a cookie is created on the client computer system to track one or more portions of information associated with the user's login attempts and wherein at least one of the portions of information associated with the user's login attempts comprises a failed login attempt counter.