5 ms·
"Disable compression (mitigation of CRIME attack)" Is this really the best solution? This might get me an A+ at ssllabs but I also need an "A" from gtmetrics[1
by sschueller 8y ago
"Disable compression (mitigation of CRIME attack)"
Is this really the best solution? This might get me an A+ at ssllabs but I also need an "A" from gtmetrics[1] and if I turn of gzip I will not get an A.
[1] https://gtmetrix.com/enable-gzip-compression.html https://gtmetrix.com/enable-gzip-compression.html
- reacharavindh 8y agoI was surprised to read that as well. I have gzip compression "turned on" in all of the nginx servers I administered. Didn't even know it could be an attack vector. https://www.acunetix.com/vulnerabilities/web/crime-ssl-tls-attack/ https://www.acunetix.com/vulnerabilities/web/crime-ssl-tls-a...
- ktpsns 8y agoWhat's probably worth saying is that (at least for Apache), you can enable compression only for certain file types, such as static text files (HTML/CSS/JS) but not dynamic files (thinking of classical CGI scripting -- PHP/Python/Ruby). It should be possible to seperate this also for modern-world fcgi services. How does HTTP2 and HTTP3 perform in this question? I always percieved deflate/gzip compression as something preferable. I never realized the CRIME attack before.
- philcrump 8y agoMy understanding is that the 'gzip' directive applies to HTTP compression, which is only performed on the body of the response (both in HTTP & HTTPS), and not SSL/TLS compression which compresses the headers and so is vulnerable to the CRIME attack. SSL/TLS compression has been disabled in nginx since 1.3.2[1] [1] http://mailman.nginx.org/pipermail/nginx-announce/2012/000087.html http://mailman.nginx.org/pipermail/nginx-announce/2012/00008...