nathforge/pyotp — pull request #6 by jboning (2014-09-29 01:22:50+00:00)
Title: Timing-attack-resistant string comparison

The current implementation leaks information about the correct value of
the OTP code in the string comparison, since python's string comparison
is short-circuiting. This fixes the vulnerability. See
http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf for why this is
important even in network applications.