This is a good article, however this part seems a bit off: > Because of the variable latency involved in most web-applications, it’s pretty much impossible to

This is a good article, however this part seems a bit off: > Because of the variable latency involved in most web-applications, it’s pretty much impossible to write a timing attack over HTTP web servers. There are certainly demonstrated timing attacks against webapps, it may take a little extra time for the attacker, but latency won't save you here, you should always use constant time comparison, there's little excuse not to.