> How viable is this in the real world? Not really viable against a native code memcmp. Potentially viable against a comparison implemented in PHP or Java. He

> How viable is this in the real world? Not really viable against a native code memcmp. Potentially viable against a comparison implemented in PHP or Java. Here's a video looking at actually implementing such attacks over LAN and internet: http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remote-timing-attacks/ http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remo... > Would a good hosting company block an attack like this at the hardware level? No, there's no generic way to defeat this. The only real limit is how granular your attacker can measure. If you're on shared hosting, you're probably the most vulnerable you can get to this (but also the most screwed already, so you probably don't cate).