The site compares MACs in the client's browser, so a timing attack is not really an issue here.