mattupstate/flask-security — pull request #252 by ocean1 (2014-05-19 18:10:37+00:00)
Title: avoid timing attacks using passlib consteq instead of ==

see hash prefix collisions here: http://www.security-assessment.com/files/documents/presentations/TimingAttackPresentation2012.pdf

unicode encoding is needed because passlib's consteq only works on unicode strings.