De-anonymizing website visitors via FB timing attacks

Site is in German. Google Translate has given me an idea as to the content of article but I'm still a little confused about how the timing attack works. Is someone able to explain this better please?