4 ms·
This _screams_ sidechannel attack.
by tsss 3y ago
This _screams_ sidechannel attack.
- patrickmeenan 3y agoHow so? SDCH had sidechannel issues which is part of why it was unshipped. I don't know that someone won't find a way to attack it but the CORS requirement already requires that the dictionary and compressed-resource be readable and the dictionary has to be same-origin as the resources that it compresses. Combined they mitigate the known dictionary-specific attack vectors.