The author of this seems to conclude that timing attacks are very difficult, because the effects seem very small. And they are pretty hard. But attackers are also very resourceful, and they have all sorts of tricks to extract signal out of noise. Even the coarsest of timers falls victim to statistics if you sample enough. And there are all sorts of tricks to increase the measured times, too: a clever attack would be to influence the heap so that the string straddles a cache line or page boundary, then force the remaining data out of the cache so you can notice a much larger bump if it gets read.