“ Not that it matters much, since you can just bypass the security control entirely, but == is not the correct way to compare hash function outputs.”

I read an excellent whitepaper on brute forcing this over the internet in ~2012 but I cannot find it. Anyone happen to know the paper I’m referring to, or if it’s still relevant with modern cpu and compiler optimisations?