What Does Timing Attack Actually Mean?

Timing attacks

Timing attacks are a class of malicious attacks against a product where the length of time that your application takes to perform a task leaks some information. Take, for example, an application that takes in an email and password to check. If there is no user with a provided email address, returns an error in 5ms, but when given a valid email for a user with an incorrect password, returns an error in 500ms.

While you should do what you can to protect against timing attacks, you can also add additional protections to be safe. Since subtle timing attacks rely on making a large number of requests, another defense here is rate limiting. By rate limiting the requests, we can make it impractical for an attacker to distinguish between different cases.

When building out authentication flows into applications, it can be easy to overlook these kinds of subtle vulnerabilities like timing attacks in code. Although it might feel strange to intentionally slow down your code, stopping the potential leak of personal information is worth the trade off.