If I have sensitive HTTP routes that could be subject to timing attacks (trying to guess an ID, user, etc.), is there a way without modifying the application code that it could be wrapped with a network tweak, proxy, or some other program so timing attacks could be obviated?
Best I've been able to find, and it's not ideal, is just adding fixed delay with
netem, but if fast and slow is (e.g.) 1 and 10 ms, would need to add a lot of delay to try to make them blur together (e.g. +100 ms, then hopefully 101 ms vs. 110 ms + random internet delay, but this isn't optimal), vs. just trying to make them all 15 ms or something.