I'm curious, to what extent are passwords exploitable if the underlying password comparison is vulnerable to timing attacks. My main concern is that internet speed continuously varies, webserver response times change depending on server load, etc.
If the timing difference is in plaintext password comparison, it is not really feasible to do this over the Internet. However, it is often possible for the attacker to get access to a computer in the same network, or even to a VM on the same hardware, by hosting his attack with the same hosting provider as the target web site.
If the site uses hashed passwords and compares the hashes instead of the plaintext password, this timing attack scenario doesn't apply anymore.