Compare Security Secrets Without Leaking Match Length
Applications compare secret values in places that look deceptively simple: message authentication codes, signed-request tags, API tokens, and other authentication material. A normal string or byte equality operator may return as soon as it finds a mismatch. When the compared value is secret, that data-dependent work can create a timing signal about how much of a guess matched. This does not mean every ordinary string comparison is remotely exploitable. Network noise, runtime behaviour, compiler optimisations, rate limits, and the surrounding protocol all affect what an attacker can measure. The defensive lesson is narrower: when equality itself protects a secret or cryptographic authenticator, do not make its comparison time depend on the matching prefix if your platform already provides a hardened comparison primitive.