Find a way to not use == in the README

[alex]

I don't think it's actually exploitable as a timing attack (in fact I'm pretty sure it's not), but I think it'd be good hygeine to offer a check_password function or similar and use that, so we dont' have to expose a general purpose constant time comparison function.

[charmander]

It’s nice not to expose a general-purpose constant-time comparison function for sure, since it’s not bcrypt’s job to do that, but you’re right that that particular timing attack doesn’t work against bcrypt either; why would it need one in the first place, exposed or not?

[wbolster]

Fwiw, the standard library provides hmac.compare_digest() since 2.7.x.

[reaperhulk]

#76 will solve this