Whoah. Careful! Timing attacks aren't relevant to password hashes, because the user doesn't control the hash, only the input to the hash, whose output is unpredictable. But cases like the TripleByte quiz, in which a user is directly submitting a hash to check (typically: an HMAC on a message) are totally relevant; in fact, they're the most common kind of legitimate timing attack.

Yes, sorry, my comment is sloppily phrased. I should have been specific. And then I may have realized I was wrong, because it wasn't about password hashes.

(It seems that tweet and the link were fresh in my memory: I automatically interpreted the question as being about password hashes, although the code actually does not imply that at all. And the linked thread is clear about the difference between password hashes and other hashes, but it seems the 'simple' message was more available to me than the deeper truth)