How much less secure is an algorithm that gives feedback that the password is one character off? If we had a stupid login procedure (SLP for short) like in this comic; it gives feedback on login, if the submitted password is one character off.

Would a longer password be less secure? What would the break-even point?

If I had a password with length 1, I would always get feedback, that I am one off, so the SLP would not make the password less secure. If I have length 2, I would get feedback half the time, so the SLP would make a password with length 2 as secure as a password with length 1?

The algorithm I would use to hash those password would be:

hash(password)
for(i=0; i++; i &lt; len(password)
  hash(password.deleteChar(i))


For login:

if(hashAndMatch(password)){
  login()
} else {
  for(i=0; i++; i &lt; len(password){
    if(hashAndMatch(password.deleteChar(i))){
      giveFeedBack()
      break;
    }
   }
   error('Wrong password or username')
 }
Let's assume that there are $95$ possible characters for a password. Thus, there are $95^n$ possible $n$ character passwords. You would like for brute force to take on the order of that many guesses to get right, $O(95^n)$.

In your case, given the additional information, once you know you have all characters right except one, it takes only an additional $95$ calls to get the exact password. So, attacking this would take $95^{n-1}+95=O(95^{n-1})$ work.

So, basically it decreases the security by one character.