Have you ever encountered a website that runs `jQuery(location.hash)`? It turns out this allows you to perform a powerful timing attack that can extract almost any secret from the HTML.