Why not actually try it? Write a timing attack. I've done it before, against a server that deliberately had a vulnerability left on it. A super-naive approach

Why not actually try it? Write a timing attack. I've done it before, against a server that deliberately had a vulnerability left on it. A super-naive approach with no statistical rigor managed to produce usable results at a slow-but-practical rate. Improved technique would have made it faster and less noisy. The big realization you quickly make is that partial accuracy is good enough to in a vast majority of cases. Sure, 100% accuracy is hard. But 50% accuracy is both surprisingly easy and surprisingly powerful.