Which timing attack is carried out by measuring the approximate time the server takes to process a POST request to deduce the existence of a username?

Which timing attack is carried out by measuring the approximate time the server takes to process a POST request to deduce the existence of a username?

• A. web-based timing attack
• B. Cookies
• C. Direct Timing Attack
• D. Cross-site Timing Attack

Answer: (C)

Timing attacks measure how long an operation takes to infer hidden information. In this scenario, when a POST request is made to log in, the server may take longer if the username exists because it proceeds with additional steps (looking up the user, fetching data, performing further checks). If the username doesn’t exist, the server can fail fast, returning an error sooner. By precisely timing the server’s response, an attacker can deduce whether a given username exists. This specific pattern—directly observing the service’s processing time to reveal internal state information—is a direct timing attack. Cookies are not about timing measurements or revealing username existence, and a cross-site timing attack implies timing data being exploited across sites, which isn’t the described scenario. A broader “web-based timing attack” term isn’t as precise for this particular method of probing user existence through login timing. To reduce such leakage, make response times uniform and avoid revealing whether a username exists through timing.

Timing attacks measure how long an operation takes to infer hidden information. In this scenario, when a POST request is made to log in, the server may take longer if the username exists because it proceeds with additional steps (looking up the user, fetching data, performing further checks). If the username doesn’t exist, the server can fail fast, returning an error sooner. By precisely timing the server’s response, an attacker can deduce whether a given username exists. This specific pattern—directly observing the service’s processing time to reveal internal state information—is a direct timing attack.

Cookies are not about timing measurements or revealing username existence, and a cross-site timing attack implies timing data being exploited across sites, which isn’t the described scenario. A broader “web-based timing attack” term isn’t as precise for this particular method of probing user existence through login timing. To reduce such leakage, make response times uniform and avoid revealing whether a username exists through timing.