Yeah, good point. If the attacker knows how long each person will wait, then they can exploit that.