Serious question - what makes the database serialization not vulnerable to timin... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		bpicolo on Aug 25, 2021 \| parent \| context \| favorite \| on: API Tokens: A Tedious Survey Serious question - what makes the database serialization not vulnerable to timing attacks in the same vein? I wouldn't expect those to be purely constant time implementations.

simonw on Aug 25, 2021 [–]

You do the final comparison outside of the database after retrieving the stored value - I use the Python secrets.compare_digest() function for that.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact