Re: Timing attacks against session cookies

Neil Schemenauer <[email protected]> Mon, 26 Jul 2010 08:28:17 -0600

Newsgroups	gmane.comp.web.quixote.user,gmane.comp.python.qp
Message-ID	<[email protected]>

On Mon, Jul 26, 2010 at 10:08:18AM -0400, Binger David wrote:
> What if hash lookup failures do no return until they have completed
> a randomized time-obscuring operation?

That makes the attack more difficult (more attempts needed) but
doesn't prevent it.

  Neil