Come to think of it, should string length also be kept secret?

If so, the length comparison would be the first part of the constant time comparison result, like

```python
result = len(a) ^ len(b)
```
and always use the length of the "internal" string for comparison so you can't try inputs that yield different length comparison strings and see when it stops taking longer for each byte you add.