4 ms·
> "gzip (which should be disabled for HTTPS)" ? Please explain.
by chrisweekly 8y ago
> "gzip (which should be disabled for HTTPS)"
?
Please explain.
- evil-olive 8y agoBREACH and CRIME [0,1] are attacks on the combination of HTTPS and compression. There are workarounds / mitigations with various effectiveness, but disabling compression when TLS is used is the simple way to prevent the attack. 0: https://en.wikipedia.org/wiki/BREACH https://en.wikipedia.org/wiki/BREACH 1: https://en.wikipedia.org/wiki/CRIME https://en.wikipedia.org/wiki/CRIME
- emj 8y agoI thought the TLS length hiding extension was supposed to fix this, I wonder why it did not progress. Maybe it is just easier to disable compression for dynamic content. [0] https://tools.ietf.org/html/draft-pironti-tls-length-hiding-02 https://tools.ietf.org/html/draft-pironti-tls-length-hiding-...