http://maverick.i2p/blog/darknet-dev
Timing Attacks Stop using standard string comparison for secrets. If I can measure how long your server takes to reject a wrong password, I can reverse-engineer it character by character. It’s called a side-channel attack. Use constant-time comparison functions for passwords, hashes, and tokens.