Surprisingly, with sufficient samples you can filter out the jitter that comes with transit time, and still execute a timing attack. From the abstract: Our wor

Surprisingly, with sufficient samples you can filter out the jitter that comes with transit time, and still execute a timing attack. From the abstract: Our work analyzes the limits of attacks based on accurately measuring network response times and jitter over a local network and across the Internet. We present the design of filters to significantly reduce the effects of jitter, allowing an attacker to measure events with 15-100µs accuracy across the Internet, and as good as 100ns over a local network. With the paper available at [1]. Nate Lawson and Tyler Nelson also did a Black Hat presentation on remote timing attacks ([2] and [3]). Bottom line is that if you're interested in using a timing attack, and you've got some effort to throw at the problem, remote ones are feasible. [1] http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9811 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9... [2] http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/ http://rdist.root.org/2010/07/19/exploiting-remote-timing-at... [3] http://www.youtube.com/watch?v=idjDiBtu93Y&feature=related http://www.youtube.com/watch?v=idjDiBtu93Y&feature=relat...