3 ms·
I don't think he means somebody is going to do the timing attack through emails. Much easier to do on the login screen or registration. You can measure the time
by yread 14y ago
I don't think he means somebody is going to do the timing attack through emails. Much easier to do on the login screen or registration. You can measure the time of response much better than with email.
- ch0wn 14y agoI thought he meant the response time of the site when an email is sent. If you synchronously sent the mail within the request-response-cycle without precautionary measures, there will be measurable difference to when no mail is actually sent.