This question already has an answer here:
What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP?
I'm a high school student, I'm new to programming and I've been learning Security since few weeks. I know Blind and Time based SQL Injection attacks and I know how are they performed and How we can prevent them. But, in this page of PHP docs explains that comparison of passwords is also vulnerable to timing attacks (when using '==' operator).
I considered that anything written in the backend of the server with PHP is safe from Client Side Perspective but here is the case totally different. The hackers can take advantage of indirect methods and guess the backend and try to exploit it. Since there are not many tutorials, stuff, information to read about how timing attacks can be performed against the PHP script which performs the comparison of 2 strings, I want to know the things to keep in mind to prevent those kinds of attacks.
I want you to answer these questions.
- If I compare hashes with md5, then will it be applicable? (practical perspective).
- If Yes, then Are there any other things which might be vulnerable apart from string comparison? (examples please)
- What is the best thing here I can do to prevent it?
- Are these attacks common/sensitive?
- A short tutorial/script to demonstrate that how timing attacks work.
This Question doesn't ask about what are timing attack, but How they are performed and How they can be prevented? (for servers on PHP only)
thank you :)