You're missing the point: in and out data via intended usage. Trying to move the goalposts afterward doesn't actually change what was intended. Consider ecesena

You're missing the point: in and out data via intended usage. Trying to move the goalposts afterward doesn't actually change what was intended. Consider ecesena's examples: > 2 identical websites, one checks your username+password for real, the other always logs you in. In that case, it's not a side channel. Presumably the intended use of authentication includes turning away bad credentials. > one stores bcrypted passwords, then other cleartext ones... That is an implementation detail. In itself, it's not a side channel because there's no way in the scenario to get the passwords. That cleartext implementation would appear at least as tough against timing attacks as bcrypt, in fact, because it would always decrypt all cleartext passwords in the same time - no info leak there.