Interesting article, I never took the time to really think about this.
For optimal security, OP mentions that we should fix the underlying code, but I kind of disagree. Understanding all the underlying code is a lot of work and, except for extremely secure application, is not really needed. Also, hindering performance for security is not always the way to go (he mentions returning only at the end).
If you have ultra-secure tasks to do, you might want to do something like calculating the execution time of the function and sleep()'ing to add padding. Example code (doesn't work):
function login(){
execstart = utime()
// whatever code
execduration = utime() - execstart;
sleep( execduration % 100 ); // pad on at 100 boundary
}
You'd have to carefully choose your padding so the execution time is (normally) not revealed in the code.
For optimal security, OP mentions that we should fix the underlying code, but I kind of disagree. Understanding all the underlying code is a lot of work and, except for extremely secure application, is not really needed. Also, hindering performance for security is not always the way to go (he mentions returning only at the end).
If you have ultra-secure tasks to do, you might want to do something like calculating the execution time of the function and sleep()'ing to add padding. Example code (doesn't work):
function login(){
}You'd have to carefully choose your padding so the execution time is (normally) not revealed in the code.