"Timing attacks at least require colocation in most cases and are much harder to implement and run for meaningful results" Not true. It's long been known that

"Timing attacks at least require colocation in most cases and are much harder to implement and run for meaningful results" Not true. It's long been known that timing attacks over a LAN are practical (replace LAN with intra-datacenter network). Relevant paper from 2003: https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf