5 ms·
XOR-based masking, yes, but I thought we were talking about currently common systems. Until BREACH nobody masked tokens, did they?
by homakov 13y ago
XOR-based masking, yes, but I thought we were talking about currently common systems.
Until BREACH nobody masked tokens, did they?
- btilly 13y agoNobody did, but that is how life goes. An attack is found. A defense is found. And you can't build a secure system without knowing all of the attacks and corresponding defenses.
- homakov 13y agoi wouldn't call it a proper defense, rather a work around. besides CSRF tokens there are lots of secret strings, and it's not website's problem to avoid wiretapping