2 ms·
BREACH and CRIME [0,1] are attacks on the combination of HTTPS and compression. There are workarounds / mitigations with various effectiveness, but disabling c
by evil-olive 8y ago
BREACH and CRIME [0,1] are attacks on the combination of HTTPS and compression.
There are workarounds / mitigations with various effectiveness, but disabling compression when TLS is used is the simple way to prevent the attack.
0: https://en.wikipedia.org/wiki/BREACH https://en.wikipedia.org/wiki/BREACH
1: https://en.wikipedia.org/wiki/CRIME https://en.wikipedia.org/wiki/CRIME
- emj 8y agoI thought the TLS length hiding extension was supposed to fix this, I wonder why it did not progress. Maybe it is just easier to disable compression for dynamic content. [0] https://tools.ietf.org/html/draft-pironti-tls-length-hiding-02 https://tools.ietf.org/html/draft-pironti-tls-length-hiding-...