> Those side-channel attacks are largely theoretical. Before you write secure software, you have to consider who your adversaries are, and what they are capabl

> Those side-channel attacks are largely theoretical. Before you write secure software, you have to consider who your adversaries are, and what they are capable of doing. Side-channel attacks over the network are definitely practical [1] [2] [3]. If you're making even a basic SaaS product, you should assume your adversaries can carry out the above. You should assume that by now, even lowly script kiddies have side-channel exploits in his arsenal. [1] Relevant paper (2010) http://www.informatics.indiana.edu/xw7/papers/WebAppSideChannel-final.pdf http://www.informatics.indiana.edu/xw7/papers/WebAppSideChan... [2] Ed Felton's analysis on [1] [3] Bruce Schneier's analysis on [1]