Maybe power draw is hard to exploit remotely, but Remote Timing Attacks are Practical (Brumley & Boneh, Stanford, 2003): http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf