snoyberg/clientsession — comment on commit 420a6e2224b03e26ac6067f1ea2ab87e1e6330c8
File: src/Web/ClientSession.hs line 244
By meteficha:

I was wondering if this opens up a window to a timing attack. Although I'm not convinced myself, it may be possible for an attacker to know that we've reached the threshold because the request took a little bit more time due to forkIO. But even if the attacker could consistently measure this, I don't see how it would hamper the security of the system. Ideally, we could choose threshold to be 2^127 and still be safe. So I guess I can sleep at night =).