FUN WITH TIMING ATTACKS

Summary from the TLDR InfoSec newsletter

Timing attacks can exploit non-constant-time string comparison functions like `startsWith` to determine secrets character by character. Attackers can deduce when a guess's prefix matches part of the secret by measuring execution times over many trials, allowing them to crack an 8-character password in just thousands of attempts rather than billions. This can be demonstrated with a browser-based implementation using Thompson Sampling and a statistical approach. Developers should avoid direct secret comparisons and instead use proper cryptographic hashing with rate limiting.