Protected orders are vulnerable to timing attacks

[aftermath2]

Describe the bug

Protected orders are vulnerable to timing attacks on their passwords because string comparisons in Python are done character by character and have a short circuiting behaviour.

robosats/api/views.py

Line 561 in 8bdfdee

if order.password is not None and order.password != password:

Making it easier to brute force the password since an attacker could analyze the time taken on different values and figure out the secret character by character. This is specially concerning if the password is short.

Even though guessing the password won't give the attacker access to the order or funds, it could allow him to impersonate the maker or simply displace him.

To prevent this, we should use hmac.compare_digest from the standard library, which always takes the same time to compare two strings, no matter their length.

See https://en.wikipedia.org/wiki/Timing_attack for further information on this kind of attack.