[darkhelmetlive]

I do have the sentence "This difference is enough to measure, even on web applications." in the fourth paragraph. Should I highlight that a bit, bold maybe?

I'd also like a good reference for that, and my Google skills were failing me. Do you happen to have a link to something show that off?

[colonelxc]

http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf

[darkhelmetlive]

Awesome, thanks!

[aidenn0]

http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

[darkhelmetlive]

Awesome, thanks! Added this and the other one to the post.

[aidenn0]

I missed that on the first read-through. Invariably when you introduce someone smart to timing attacks they will say "Oh, but that's not going to be practical over TCP/IP.