Directly addresses in the article: > Can't the server just delay every password-checking response for exactly 1 millisecond, independently of how long the pass

Directly addresses in the article: > Can't the server just delay every password-checking response for exactly 1 millisecond, independently of how long the password checking took? It's normal for computers to have many operations that they're trying to get done simultaneously. Often operations interrupt other operations, and interruptions can last for many seconds when computers run out of RAM. Building a fixed-response-time mechanism that robustly accounts for this is an open problem. > More fundamentally, when the password check finishes and switches to idling until the response time, the computer normally switches to other operations, speeding up those operations. This is often visible through the timing of those operations even if the timing of the password-checking response is controlled.