title: Is bcrypt.compare vulnerable to timing attack
body: <p>In Node.js web development I saw it as a common practice to use <code>bcrypt</code> for hashing and comparison of password. Is <code>bcrypt.compare</code> vulnerable to <a href="https://snyk.io/blog/node-js-timing-attack-ccc-ctf/" rel="nofollow">timing attack</a>?</p>