I was looking at doing some encryption and hashing in PHP and came across this note
Please be careful when comparing hashes. In certain cases, information can be leaked by using a timing attack. It takes advantage of the == operator only comparing until it finds a difference in the two strings.
It seems to me that in most cases the difference in comparing two strings is only going to be a few clock cycles. Given the overhead in HTTP, PHP and changes in network latency, there will be a lot of variation in the time taken to process a request. I don't see that using such an attack over the public internet.
Has such an attack ever been demonstrated in a real-world situation?
I'm not saying that you shouldn't protect against it just in case, I am just wondering how big the risk actually is.