You’re Probably Doing String Comparisons Wrong, Here’s Why

Photo by William Warby on Unsplash

This is something cool I learnt about recently when building an application in GO. This is something that is so easily overlooked and can leave so many applications open to vulnerabilities. You are probably used to using the comparison operator == when comparing two strings, cause why not? It’s easy, quick and it works. But does it? Say you are using this comparison for your API auth you have just left your application open to a big old guessing game.

Let me break down why this is dangerous. When you use the == operator to compare strings, it’s doing something sneaky behind the scenes — it stops comparing as soon as it hits a character that doesn’t match. Think about it like checking a password: if someone enters “axxx” and your real password is “abcd”, the comparison stops dead at that second character.

Now, here’s where it gets interesting. This seemingly innocent behaviour creates tiny, microscopic differences in how long the comparison takes. If an attacker gets the first character right, the comparison takes ever so slightly longer because it has to check the second character too. Get two characters right? Takes even longer.

These miniscule timing differences might seem insignificant, but to an attacker with the right tools, they’re like breadcrumbs leading straight to your secret key. By making thousands of requests and measuring these timing differences, they can gradually piece together your API key, one character at a time.

The solution? Enter constant-time comparison. In Go, this is as simple as using subtle.ConstantTimeCompare():

isAuthed := subtle.ConstantTimeCompare([]byte(authHeader), []byte(os.Getenv("ADMIN_KEY"))) == 1

This little function is your shield against timing attacks. It’s clever because it always takes the same amount of time to run, regardless of how many characters match. It checks every single byte, every single time, making those tiny timing differences disappear completely.

So next time you’re writing authentication code, remember: that simple == might be convenient, but it’s also potentially leaving your door unlocked. Take the extra step to use constant-time comparison — your future self (and your users) will thank you for it.

I specialize in optimizing logistics operations through custom software development, process automation, and digital transformation. View my complete portfolio at albarel.dev to see how I’ve helped companies streamline their operations and boost efficiency.