They wouldn't be guessing, they'd be measuring. I'm not qualified to really explain more but if you want to learn more, "timing attack" is what you're looking f

They wouldn't be guessing, they'd be measuring. I'm not qualified to really explain more but if you want to learn more, "timing attack" is what you're looking for https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack