Collected research

Exposing Private Information by Timing Web Applications

Boneh Publications: Exposing private information by timing web applications

Andrew Bortz, Dan Boneh and Palash Nandy · crypto.stanford.edu

Web response times leak private state. Direct timing distinguishes valid from invalid usernames at login pages and counts hidden photo albums behind access control, accurate above 95% from ten samples.

Record

Document

Boneh Publications: Exposing private information by timing web applications

Researcher

Andrew Bortz, Dan Boneh and Palash Nandy

Published by

crypto.stanford.edu

Topic

Other

In the archive

• Collected in the 2007 research round

Related sources

• paper555 Whitepaper

Tags

• timing-attack
• side-channel
• xsleak
• info-leak
• csrf
• same-origin-policy
• measurement-study
• mitigation
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Andrew Bortz, Dan Boneh and Palash Nandy, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 8 August 2026.