This is a <i>huge</i> issue. We really need leaders to start being aggressive with bringing down the variation. It&#x27;s damaging the benefit of using TLS at all, and I&#x27;d argue browser vendors would be making their users safer by having browsers force HTTP (or outright reject) on websites that aren&#x27;t maintained enough to do TLS1.2 than allowing HTTPS and ultimately hurting the whole ecosystem.<p>I don&#x27;t see a mention of timing in this paper, either. I suspect that it is another viable identifier. After accounting for latency, the speed of the response can give you an idea of what hardware they&#x27;re using.