How many times would an attacker have to enter the same password when doing a string comparison timing attack? I assume it would have to be at least a few dozen times to average out network lag, for example. If the number is significantly more than the number a normal user would enter, is checking the number of times a person enters a password an effective way to combat string comparison timing attacks? For example, if the tries of the same password exceeds 100 then require a CAPTCHA? Is this more resource efficient than simply checking the whole password?
You should already be rate-limiting login attempts after a few requests (temporary lockout, CAPTCHA, Clippy popping up and berating you, etc.). This is a common way to stop brute-force attacks, and it will also seriously cripple those trying to do timing attacks.
Also, if you're hashing passwords and looking them up in a database, timing attacks shouldn't be very relevant. The attacker would have to be able to produce arbitrary hashes to gradually "home in" on the right one. This is very difficult!
Timing attacks will be more relevant for things like session cookies