diff --git a/django/contrib/auth/backends.py b/django/contrib/auth/backends.py
index 6b31f72..2eaf6c8 100644
--- a/django/contrib/auth/backends.py
+++ b/django/contrib/auth/backends.py
@@ -2,6 +2,8 @@ from __future__ import unicode_literals
 from django.contrib.auth import get_user_model
 from django.contrib.auth.models import Permission
 
+from time import sleep
+from random import random
 
 class ModelBackend(object):
     """
@@ -10,6 +12,14 @@ class ModelBackend(object):
 
     def authenticate(self, username=None, password=None, **kwargs):
         UserModel = get_user_model()
+
+        user = UserModel()
+        user.set_password("if user doesn't exist we still want to be slow")
+
+        #sleep for random amount of time to add some secret sauce
+        #to the time it takes for authentication
+        sleep( (random() + .25) % .5)
+
         if username is None:
             username = kwargs.get(UserModel.USERNAME_FIELD)
         try:
@@ -17,6 +27,7 @@ class ModelBackend(object):
             if user.check_password(password):
                 return user
         except UserModel.DoesNotExist:
+            user.check_password("this won't match that!")
             return None
 
     def get_group_permissions(self, user_obj, obj=None):