This is a good overview, but I think some more actionable advise would be helpful, especially given the beginner audience.
Following the API key example, I'd usually hash these when storing them in the database. This side steps the issue, as hashing the attacker's guess doesn't leak any timing information about the secret. The final string comparison (hash_guess == hash_expected) will leak timing information about the hash of the API key, but that doesn't leak information about the un-hashed API key.
Interestingly, there are lots of frameworks that use timing-sensitive checks. Django, for example, uses timing-sensitive look-ups [1]. Building a practical attack could yield a trove of bug bounties...
8organicbits•1d ago
Following the API key example, I'd usually hash these when storing them in the database. This side steps the issue, as hashing the attacker's guess doesn't leak any timing information about the secret. The final string comparison (hash_guess == hash_expected) will leak timing information about the hash of the API key, but that doesn't leak information about the un-hashed API key.
Interestingly, there are lots of frameworks that use timing-sensitive checks. Django, for example, uses timing-sensitive look-ups [1]. Building a practical attack could yield a trove of bug bounties...
[1] https://code.djangoproject.com/ticket/31412