Sec Credential Stuffing

Where this is already explained

• The Slowness Is the Feature

  That salting a fast cryptographic hash such as SHA-256 makes it suitable for passwords, because the salt is what stops the attack. The salt stops precomputation and stops one computation covering many accounts; it does not make a single guess cost one cycle more. What makes guessing uneconomic is the work factor — the deliberate cost of each evaluation — and a general-purpose hash is fast by design, which is precisely the property you do not want here.

• The Timing Leak That Matters Skips Work, Not Bytes

  That timing attacks are about comparison loops, so replacing == with a constant-time compare closes the channel. The difference a byte comparison makes is about 2.4 nanoseconds, which no filter recovers across a network at any practical sample count. The differences that are trivially readable are branches that skip work — an early return before the password hash is about 240 milliseconds, a hundred million times larger, and two requests find it. Teams add hmac.compare_digest and leave the account-enumeration oracle in place.