Timing-Attack

The password check returned as soon as a character was wrong, so response time leaked the password one character at a time.