3 ms·
This is suggested every time timing attacks are discussed. This is not a good mitigation. It increases the number of requests required to complete a timing atta
by NeutronBoy 12y ago
This is suggested every time timing attacks are discussed. This is not a good mitigation. It increases the number of requests required to complete a timing attack, but in the end all of your rand() calls average out and you still see timing differences.
- cousin_it 12y agoOK, then why not have the sensitive operation always take 100ms? If it finishes early, just sleep until the 100ms mark.
- daveloyall 12y agoAnd in case it takes more than 100ms or a widely variable amount of time: https://news.ycombinator.com/item?id=8691076 https://news.ycombinator.com/item?id=8691076
- deleted 12y ago[deleted]