avoid using == comparison to avoid timing attacks