Added a list of potential mitigations to timing attacks

[yoavweiss]

Based on @tomrittervg's comment.
Closes #67

---

Preview | Diff

[yoavweiss]

/cc @tomrittervg - can't add you to reviewer list...

[tomrittervg]

For example, cache attacks
and statistical fingerprinting is a privacy and security concern where a
and statistical fingerprinting is a privacy and security concern where a
malicious web site may use high resolution timing data of various browser
malicious web site may use high resolution timing data of various browser
or application-initiated operations to differentiate between subset of
or application-initiated operations to differentiate between subset of
users, and in some cases identify a particular user - see
users, and in some cases identify a particular user - see
[[?CACHE-ATTACKS]].

I think we could go further here: it's not just fingerprinting that's a concern here; it's also user data such as browsing history, user activity, and private data include all data resident in the browser process (Spectre).

Otherwise, the changes LGTM.

[igrigorik]

lgtm, modulo comment on linking to the issue tracking how different browsers have chosen to address spectre implications?

[yoavweiss]

@igrigorik - PTAL

[igrigorik]

👍