Formal Models of Timing Attacks on Web Privacy