Just to play the devil's advocate. It takes a few lines of code if you are in a language or system where you're controlling everything. If you're in a high level language where you don't control how comparison is implemented, it could get harder. Even more, comparison is only the start of conceivable timing attacks. Suppose you could use decryption time or look-up time or whatever? What would seem nice about operating on the packet level is that you could stop potential future attacks.