[tptacek]

The leak that you're ostensibly timing is that in order to figure out how much of the candidate MAC string was valid, the target had to compare more byte, which takes more time, which adds observable lag to the error response.

[gav]

Is the observable lag for a string comparison significant enough to be useful?

We're talking about such small amounts of time compared to the overhead of the full web stack.

[Mvandenbergh]

The observable lag isn't usually significant enough if you only do it once but over many requests the stochastic factors can be compensated for.