Also, this shouldn't even be a source of information if the password is salted and hashed to a fixed length before storing. I'd hope any secure system was at least doing this to start with anyway.
Our work analyzes the limits of attacks based on accurately measuring network response times and jitter over a local network and across the Internet. We present the design of filters to significantly reduce the effects of jitter, allowing an attacker to measure events with 15-100µs accuracy across the Internet, and as good as 100ns over a local network.
With the paper available at [1]. Nate Lawson and Tyler Nelson also did a Black Hat presentation on remote timing attacks ([2] and [3]). Bottom line is that if you're interested in using a timing attack, and you've got some effort to throw at the problem, remote ones are feasible.
[1] http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.9...
[2] http://rdist.root.org/2010/07/19/exploiting-remote-timing-at...
[3] http://www.youtube.com/watch?v=idjDiBtu93Y&feature=relat...