Can someone please explain to me ...
We should not be comparing passwords character by character since we should not store passwords in clear text -- as it is a nightmare if/when some cracker gets hold of the password database.
We should store a hash or message digest of the password and when testing a candidate password hash/md it and compare that. Converting to a hash/md means reading *all* of the password and then comparing the result will give you no clue as to which pass of the candidate password is bad; so a timing attack will not work.
Anyway: the first step of authentication will be getting the password hash/md, very likely from a database. The time to access from a database will take vastly longer than character by character comparison.
So: I do not understand. Can someone please explain.
Thanks