use a constant-time comparison function to check user passwords

authserv/auth.py

 import crypt
+from werkzeug.security import safe_str_cmp
 from authserv.oath import accept_totp
 from authserv import protocol
 
 
 def _check_main_password(userpw, password):
-    if crypt.crypt(password, userpw) == userpw:
+    if safe_str_cmp(crypt.crypt(password, userpw), userpw):
         return protocol.OK
     else:
         return protocol.ERR_AUTHENTICATION_FAILURE
@@ -12,7 +13,7 @@ def _check_main_password(userpw, password):
 
 def _check_app_specific_password(asps, password):
     for app_pw in asps:
-        if crypt.crypt(password, app_pw) == app_pw:
+        if safe_str_cmp(crypt.crypt(password, app_pw), app_pw):
             return protocol.OK
     return protocol.ERR_AUTHENTICATION_FAILURE