3 ms·
Aren't there security concerns using gzip and HTTPS? Could this be a space efficient alternative when gzip is disabled?
by sikosmurf 10y ago
Aren't there security concerns using gzip and HTTPS? Could this be a space efficient alternative when gzip is disabled?
- krschultz 10y agoI would be interested to learn more about those concerns. My "default" setup these days is HTTPS & gzip everything, but I can't say I've read any white papers on the security implications of that.
- zrm 10y agoIf the attacker knows or controls any part of the data then the compressed size leaks information about the unknown data because the compressed size will be smaller if the known data shares bytes with the unknown data.
- Drdrdrq 10y agoThanks for the explanation! Attack: https://en.m.wikipedia.org/wiki/BREACH_(security_exploit) https://en.m.wikipedia.org/wiki/BREACH_(security_exploit)