diff --git a/cmd/micromdm/serve.go b/cmd/micromdm/serve.go
index 8d18913b..80a86b4c 100644
--- a/cmd/micromdm/serve.go
+++ b/cmd/micromdm/serve.go
@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/subtle"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
@@ -796,7 +797,7 @@ func HasCN(db *boltdepot.Depot, cn string, allowTime int, cert *x509.Certificate
 		certKey := []byte(cert.Subject.CommonName + "." + cert.SerialNumber.String())
 		certCandidate := bucket.Get(certKey)
 		if certCandidate != nil {
-			hasCN = bytes.Compare(certCandidate, cert.Raw) == 0
+			hasCN = 1 == subtle.ConstantTimeCompare(certCandidate, cert.Raw)
 		}
 		return nil
 	})
diff --git a/pkg/crypto/password/password.go b/pkg/crypto/password/password.go
index 32167652..fc71219c 100644
--- a/pkg/crypto/password/password.go
+++ b/pkg/crypto/password/password.go
@@ -3,9 +3,9 @@
 package password
 
 import (
-	"bytes"
 	"crypto/rand"
 	"crypto/sha512"
+	"crypto/subtle"
 	"errors"
 	"math/big"
 
@@ -50,7 +50,7 @@ func SaltedSHA512PBKDF2(plaintext string) (SaltedSHA512PBKDF2Dictionary, error)
 // password dictionary.
 func Verify(plaintext string, h SaltedSHA512PBKDF2Dictionary) error {
 	hashed := pbkdf2.Key([]byte(plaintext), h.Salt, h.Iterations, macKeyLen, sha512.New)
-	if !bytes.Equal(h.Entropy, hashed) {
+	if 1 == subtle.ConstantTimeCompare(h.Entropy, hashed) {
 		return ErrNoMatch
 	}
 	return nil