0
votes
1answer
52 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
1
vote
2answers
215 views

How to defeat CRIME, BREACH, TIME etc… server side (without sacrificing compression)

I am writing full-stack server side software and I have been researching CRIME attacks and it's relation to SPDY header compression as I am implementing the server side codecs for it at the moment. ...
25
votes
4answers
6k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...