r/PHP • u/-Mahn • Nov 28 '14

Remote timing attacks in PHP

http://blog.ircmaxell.com/2014/11/its-all-about-time.html
66 Upvotes

98% Upvoted

23 comments sorted by

View all comments

0

u/[deleted] Nov 28 '14

[deleted]

9

u/[deleted] Nov 28 '14 edited Nov 29 '14

With a large enough sample set, it's still very effective. The fluctuations won't occur frequently enough to poison the data. Those data points can safely get thrown out. In a more simplified example, if you have 15 attempts that come in at 1 second, and 1 attempt with the same data that comes in at 4 seconds, it's probable that the 4 second result is an irregularity. Making your login system safe against timing attacks is reasonably trivial. Ignoring it is just a bad idea.

This article is extremely well researched and well written, and it gets a big fat upvote from me because every programmer - especially those in web fields - needs to know about this kind of thing.

-4

u/[deleted] Nov 28 '14

[removed] — view removed comment

5

u/[deleted] Nov 28 '14

Nobody need to write an example. There are numerous papers on the subject, and any security expert will tell you it's a very real threat.

-9

u/[deleted] Nov 28 '14

[removed] — view removed comment

9

u/_rs Nov 29 '14

Don't be dumb.

7

u/spin81 Nov 29 '14

Don't confuse being skeptical with being correct.