[white_devil]

Well, it's somewhat comforting to know it's mostly about user input. Thanks! Not that it's easy to secure input handling either.

I've seen that kind of timing attack discussed somewhere, and the solution there was to do some kind of byte-by-byte comparison that would always take the same amount of time. It makes sense.