4 ms·
Won't help in this case.
by thatwonthelp 14y ago
Won't help in this case.
- tptacek 14y agoI don't know what you're saying. If you're saying that the "Secure" flag won't defend against CRIME, nobody is saying that. I'm saying that the "Secure" flag and HSTS mitigates SSL-stripping.
- bdr 14y agoOddly, GP's account was made for the purpose of writing that comment. I'm unsure what that means.
- tlrobinson 14y agoI think both ivanr and thatwonthelp were suggesting that any non-secure site (same origin or not) can be hijacked in order to make the requests necessary for this attack. I understand and agree with your comment about the secure flag, but if I understood ivanr's comment it doesn't apply.