Why in the world would you use such a method? PHP is a lot of things, but definitely not timingsafe, even for simple comparisons like the one that you removed here. There is no reason to use this method, quite the opposite. The sane way would be to remove this method. There is no way for an attacker to measure the time that the comparison of the two strings took in all of the noise that the rest of Joomla, and the web around it, produced. Transfering the whole thing over the wire has more variance in it than the whole comparison. So please change that back to what it was and instead remove that method from JCrypt.