Rob Auger from OWASP/WASC/CGiSecurity on Timing..

This mailing-list excerpt describes a timing-based CSRF technique for distributed brute-forcing of login pages, referencing research papers and diagrams that show how timing differences in a victim's browser can be used to detect successful logins and notify an attacker; the content is research/discussion-oriented rather than a report of active exploitation.