Many timing attacks are viable in web applications. But there aren't timing attacks against password hash comparisons, for obvious reasons.