It's harder to mitigate than CRIME, but CRIME was leaps and bounds more useful. Since you were guaranteed to have control over some reflected plaintext in the r

It's harder to mitigate than CRIME, but CRIME was leaps and bounds more useful. Since you were guaranteed to have control over some reflected plaintext in the request, life was much easier. With BREACH, you have to first find a plaintext reflection, and there are certainly many page where one simply does not exist.