When comparing strings for equality, usually the function returns false as soon as it knows the strings aren't equal. This means that an attacker can measure the time it takes to compare the strings and determine how far into the string the comparison fails. He/she can use that to grow a prefix for such a string, until the prefix matches the entire string. This spells doom for comparing password strings or even their hashes. James Reeves has issued a micro-library for comparing strings which always checks every character. I favor these types of micro-libraries because they effectively service a specific need. | 