I guess I'm missing the practical vector associated with the "compare" timing attack. All of the js source code is available to see in a debugger, as well as all of the stored memory values. If you've put sensitive information (a secret) in the browser, you've already failed...