[varun_ch]

Here's a timing attack that doesn't need any user interaction: https://ndev.tk/visted/

[jfk13]

Only seems to work in Chrome (not Safari or Firefox).

[throwawayadvsec]

awesome thanks!