2 ms·
I'm so surprised that the security consideration section has no reference to CRIME [1], which has made Google and Mozilla to turn off SPDY's header compression
by cryptbe 14y ago
I'm so surprised that the security consideration section has no reference to CRIME [1], which has made Google and Mozilla to turn off SPDY's header compression in Chrome and Firefox.
[1] https://docs.google.com/presentation/d/11eBmGiHbYcHR9gL5nDyZChu_-lCa2GizeuOfaLU2HOU/present#slide=id.g1d134dff_1_100 https://docs.google.com/presentation/d/11eBmGiHbYcHR9gL5nDyZ...
- njs12345 14y agoI think this version is basically SPDY 3. SPDY 4 (draft spec: https://github.com/grmocg/SPDY-Specification/blob/gh-pages/draft-mbelshe-httpbis-spdy-00.txt https://github.com/grmocg/SPDY-Specification/blob/gh-pages/d...) uses a completely new header compression algorithm which is not susceptible to the attack used in CRIME.