[throwawayadvsec]

is user input needed or can it be done without it?

[jesprenj]

needed

[throwawayadvsec]

so I just spent the last hour tinkering with it, I think there is definetly room for some timing attack, at least on firefox, there is a pattern

[varun_ch]

Here's a timing attack that doesn't need any user interaction: https://ndev.tk/visted/

[jfk13]

Only seems to work in Chrome (not Safari or Firefox).

[throwawayadvsec]

awesome thanks!