Classic channels: execution time that depends on secret bits (Kocher, 1996), secret-dependent memory accesses observed through shared caches (Flush+Reload and similar), power and electromagnetic traces of smart cards and microcontrollers, and fault injection (voltage or clock glitches, lasers, Rowhammer) that makes a device output a faulty signature from which the key can be computed. Remote timing is practical too: Lucky Thirteen (2013) attacked TLS CBC padding checks over the network.
Asymmetric cryptography is especially exposed because scalar multiplication and modular exponentiation loop over key or nonce bits. Defenses are constant-time code (no secret-dependent branches, memory indices or variable-time instructions), blinding of scalars and messages, complete formulas with uniform ladders, and, against faults, verifying a signature before releasing it and hedged nonces.
For developers the practical rule is to use maintained libraries with a record of constant-time work (BoringSSL, OpenSSL, libsodium, Go's crypto, RustCrypto, the noble libraries) and never reimplement arithmetic. In languages with JIT compilers or garbage collection, constant-time behavior is best effort, which matters on shared hosts and in browsers.