[frik]

How to protect from timing attacks - It's All About Time: http://blog.ircmaxell.com/2014/11/its-all-about-time.html

[sarciszewski]

password_verify() compares hashes in constant-time, so, yeah...