Timing attacks, never saw a real world exploit working for them. Even in my local tests without web server latency the results are indistinguishable.

Did anyone ever show a working timing attack for a web service? Even assuming no DoS/request limiting is in place.