This was somewhat famously broken in Java until late 2009: https://codahale.com/a-lesson-in-timing-attacks/ https://codahale.com/a-lesson-in-timing-attacks/ t

This was somewhat famously broken in Java until late 2009: https://codahale.com/a-lesson-in-timing-attacks/ https://codahale.com/a-lesson-in-timing-attacks/ tl;dr, the method for doing "secure" string comparison was vulnerable to timing attacks for much of Java's history.