For those who might have a hard time going through the summary, the attack is very simple:<p>If I block you, then when you load my twitter page, the load takes less time than if I don't block you.<p>So if the attacker wants to track 2^^N users, they number these users 1 ... 2^^N and each user can be given a binary number that is 0 or 1 in N positions, corresponding to whether N fixed accounts block them or not.<p>So, there is a lot of set up work to create N bot accounts that together block or don't block 2^^N people.<p>Then, the attacker tricks a user to loading their webpage which has a script that loads each of the N twitter profiles. If you are logged into twitter, your session cookie will be sent and the load time will be different or not for each of these accounts and so the attacker will be able to identify you if you are in the group of 2^^N users.<p>This type of attack is awesome (in a dark way) in that it can work for a lot of sites other than twitter. It points out a general weakness whenever a social media website takes a different time to load based on an attribute not in your control.<p>For example, it doesn't work with 'friends' if you need to approve friends, as you wont approve the bots friending you, but you can't block the bots from blocking you. Amazing.<p>The long term solution is same site cookies, which is also a solution for a lot of these CSRF type attacks. Great stuff.