I've looked into timing attacks in the past but failed to exploit one. Even running php locally from the command line, eliminating any possibility of network randomness, I couldn't get even a few bytes with any amount of certainty.
Not saying it's not an issue, but I'm not so sure it's a big deal either.
Not saying it's not an issue, but I'm not so sure it's a big deal either.