You don&#x27;t need to control every byte for this to be catastrophic. You can&#x27;t decode every password like you can with the previous comparison, but if you can generate a rainbow table that contains the password you&#x27;re trying to crack, you can just do a timing attack using the hashes instead. My intuition is that this might even require fewer attempts than the original comparison assuming a reasonable password length, but I haven&#x27;t done the math.