justacomme555

Youre right... the delay would basically have to be chosen dynamically to enforce a universal page load time for all html documents on twitter.com

Still feels nicer than forcing a roundtrip

I feel one better fix is to just add a small random wait from the time </html> is served and the TCP socket is actually closed. I donnt think? this should impact loads of the page when it is rendered in an html context.

The article describes that certain privacy extensions break the page from loading. It was probably ghostery.

Honestly though the blank page fix seems horrible... especially when you consider twitter has worked very hard for the “above the fold” load times, at one point rendering it server side.

I also wonder if the attacker just pops a new window ( after getting the user to click anywhere) and load the twitter page into it, if they can still time the request the same way.