A Lesson In Timing Attacks (or, Don’t use MessageDigest.isEquals) @ codahale.com
“Every time you compare two values, ask yourself: what could someone do if they knew either of these values? If the answer is at all meaningful, use a constant-time algorithm to compare them.”