This should explain more about timing side channels, also explain when the constant time comparison operations **MUST** be used, for example, any time you're comparing something you *received* to a *secret* you know.

As per the documentation guidelines it may be best to provide several references, the stuff from Root Labs is probably a good place to start:
 * http://rdist.root.org/2010/01/07/timing-independent-array-comparison/
 * http://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar-library/
 * http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remote-timing-attacks/