I'm skeptical that this attack would work against the Java implementation. Surely a language which rivals C for performance does not compare arrays of primitiv

I'm skeptical that this attack would work against the Java implementation. Surely a language which rivals C for performance does not compare arrays of primitives one byte at a time? I've thought about locally attacking Unix password authentication in a similar way for quite some time by throwing random passwords at something like 'su' until I have guessed the first 3-4 bytes of the password hash (with timing) and then performing a dictionary attack against the truncated hash. This could never work though unless the hashes are compared bytewise instead of with something like an optimized memcmp().