In fact the bottom line is > The time differences for individual characters are often below one nanosecond, making it virtually impossible to detect remotely.

In fact the bottom line is > The time differences for individual characters are often below one nanosecond, making it virtually impossible to detect remotely. What I'm taking away is: scrutinizing the algorithm used for string comparison should be low priority compared to other security-related concerns.