It reminds me of the gmail timing attack. I can't find the link anymore and I don't remember it precisely but it was something like loading the auth page for

It reminds me of the gmail timing attack. I can't find the link anymore and I don't remember it precisely but it was something like loading the auth page for a specific address in the background and depending on the load time you'd know if the person was already logged in with that address. It assumed there was a specific list of people you were targeting whose address you already knew and you could show different content to a specific target.