René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Timing vulnerability?","articleBody":"I've been working on implementing bcrypt-ruby and have been reading about timing attacks, particularly your article here:\n\nhttp://codahale.com/a-lesson-in-timing-attacks/\n\nI notice that Devise (popular gem that uses bcrypt-ruby) implements a constant-time comparison algorithm in conjunction with bcrypt-ruby:\n\nhttps://github.com/plataformatec/devise/blob/master/lib/devise.rb#L424\n\nI also notice that bcrypt-ruby's BCrypt class inherits from Ruby's String class, and the BCrypt#== method simply calls up to super, thus comparing strings using Ruby's String#== method, which I assume is not a constant-time comparison algorithm.\n\nShould BCrypt handle this constant time issue in it's comparison method?\n","author":{"url":"https://github.com/corporealfunk","@type":"Person","name":"corporealfunk"},"datePublished":"2012-07-12T22:53:09.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":5},"url":"https://github.com/42/bcrypt-ruby/issues/42"}