This question already has an answer here:

I'm curious, to what extent are passwords exploitable if the underlying password comparison is vulnerable to timing attacks. My main concern is that internet speed continuously varies, webserver response times change depending on server load, etc.

marked as duplicate by Sjoerd, tim, Community Mar 22 '17 at 13:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


If the timing difference is in plaintext password comparison, it is not really feasible to do this over the Internet. However, it is often possible for the attacker to get access to a computer in the same network, or even to a VM on the same hardware, by hosting his attack with the same hosting provider as the target web site.

If the site uses hashed passwords and compares the hashes instead of the plaintext password, this timing attack scenario doesn't apply anymore.

Not the answer you're looking for? Browse other questions tagged or ask your own question.