Explanation of Timing Attacks

Let’s say you want to know if your boss is away on vacation next week. So you call their admin and say “Can you double-check that my phone number is correct if the Boss is out next week?”.

They load up the boss’ calendar to check and based on his presence next week then load up your info.

Only once done, do they take the time to remember the boss didn’t want you to know wether they are in or out. So you hear back, “sorry, can’t tell you that”.

But now you follow up with “OK, well can you still double check that my phone number is…”

If they respond quickly with a yes, then your file is still on their screen and the boss is in fact out next week. If there is a short pause while they look it up, then the opposite.

source