Here's another paper that talks about these sorts of attacks. http://crypto.stanford.edu/~abortz/papers/timingweb.pdf http://crypto.stanford.edu/~abortz/papers

Here's another paper that talks about these sorts of attacks. http://crypto.stanford.edu/~abortz/papers/timingweb.pdf http://crypto.stanford.edu/~abortz/papers/timingweb.pdf The suggested defense (which the authors implemented as mod_timepad) is to quantize the response time to 100ms or so, so that it is more difficult to extract meaningful information. However, this requires server-side implementation, so it's not very useful for clients who are trying to protect their own browsing. One option (albeit a performance-degrading one) would be to implement the same quantization in a local proxy. You might even be able to just plug mod_timepad and mod_proxy together.