Comment Re:Not much of a threat really (Score 1) 40
There is one saving grace with those "spectre" types of attack is they rely on measuring tiny changes in timing over a relatively long time to gather one single bit out of statistical noise.
And they need the system to be very "quiet".
It's like listening to a mouse's noises inside a cabinet to infer how many cans of food are in there without opening the door.
It stops working when the neighbor is throwing a trash-metal party, drowning everything in noise.
The proof-of-concepts fails when programs other than the target are also running hard.
Fixes in theory can be implemented in software: anything raising the noise floor above the data we want to secure.
Do extra unnecessary calculations both random and fake static keys in parallel to the real decoding operation.
Generate so much noise that it'd take the heat-death of the universe to statistically figure out the bits, or at least long enough that the sensitive data is long gone from memory.
In combination to frequently transforming the stored data using random XOR keys, by the time one bit is figured out that bit has already been randomly invalidated, with not enough time to figure out both the random XOR key and the actual data we're interested in.