A problem with that approach: You can discover what internal strings are held in a web application via a timing attack. Better hope you never hold onto a refe

A problem with that approach: You can discover what internal strings are held in a web application via a timing attack. Better hope you never hold onto a reference to internal credentials inside the application! (Say... DB username / password? Passwords before they're hashed? Etc.)