For Ruby you should be using ActiveSupport::SecurityUtils.secure_compare or similar. In theory openssl could return a String-like object with an overridden ==,

For Ruby you should be using ActiveSupport::SecurityUtils.secure_compare or similar. In theory openssl could return a String-like object with an overridden ==, but it doesn't.