4 ms·
> naive implementations of the best practice will also leak that via a side channel Shouldn't the best practice of sending emails include using at least some s
by ch0wn 14y ago
> naive implementations of the best practice will also leak that via a side channel
Shouldn't the best practice of sending emails include using at least some sort of message queue? You're probably right that most web apps will use a synchronous call for this, which is easy to run a timing attack against, but it should be easy to fix this without spending $20k on a security consultant.
- yread 14y agoI don't think he means somebody is going to do the timing attack through emails. Much easier to do on the login screen or registration. You can measure the time of response much better than with email.
- ch0wn 14y agoI thought he meant the response time of the site when an email is sent. If you synchronously sent the mail within the request-response-cycle without precautionary measures, there will be measurable difference to when no mail is actually sent.