The Tangled Web

Timing Attacks on User Interfaces

The problems we’ve discussed so far in this chapter may be hard to fix, but at least in principle, the solutions are not out of reach. Still, here’s a preposterous question: Could the current model of web scripting be fundamentally incompatible with the way human beings work? By that, I do not mean merely the dangers of web-delivered social engineering that targets the inattentive and the easily confused; rather, I’m asking if it’s possible for scripts to consistently outsmart alert and knowledgeable victims simply due to the inherent limitations of human cognition?

The question is outlandish enough not to be asked often, yet the answer may be yes. Consider that in a typical, attentive human subject, the usual ...