4 ms·
Did you even read the article you linked? The CRIME attack involves SSL/TLS, that both HTTPS and SPDY use.
by riquito 13y ago
Did you even read the article you linked? The CRIME attack involves SSL/TLS, that both HTTPS and SPDY use.
- laumars 13y agoThe CRIME attack isn't just blindly attacking SSL/TLS like you rudely insinuated. CRIME specifically targets traffic over compressed SSL/TLS connections, using the deflation to leak cookies. The simple fix to this is to disable SSL/TLS compression, which is easily done in HTTPS (and in fact should be disabled if you want PCI compliance), but SSL/TLS compression cannot be disabled in SPDY. Sorry I didn't categorically spell this out for you earlier, I forgot some people need spoon-feeding the facts about the technology they advocate - even after you've already cited a massively dumbed down article on the subject already. (and nasty tone of my post is a result of me getting fed up with the way how you, and everyone else it seems, feels is appropriate to talk to each other on HN. This place never used to be quite so rude)
- riquito 13y agoI'm sorry, I was certainly rude, please excuse me.