[wolfwyrd]

hmac.compare_digest is constant time whereas == will return as soon as a mismatch is found. The difference in return time can be measured. The key phrase is a Timing Attack[0].

[0]https://en.wikipedia.org/wiki/Timing_attack