Something not mentioned here is that timing attacks have been proven effective even across the internet; you might think "Oh the jitter in TCP is going to overwhelm any leaked information," but you would be wrong.