Just playing around a bit, you can get [millisecond level timing info](https://gist.github.com/mastahyeti/6802156) on a cross-domain POST, but that obviously isn't enough for a timing attack against string comparisons.