I don't know why the authors didn't make a website for the SCISSOR attack (a.k.a the cookie cutter attack in the paper), which is way more practical and (imho)

I don't know why the authors didn't make a website for the SCISSOR attack (a.k.a the cookie cutter attack in the paper), which is way more practical and (imho) much cooler than this session resumption thing. The idea of that attack is similar to what we did in CRIME, but applies to HTTP responses. Basically you inject enough data to split the response into two records and drop the second one. Some browsers would happily accept the truncated response, and change their state. As a result you could remove the Secure flag on the Set-Cookie header, and steal the cookies if the server or the client doesn't support HSTS.