Skip to main content
Information Security

Return to Question

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

I've read CRIME - How to beat the BEAST successor?CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators.

As a web host, should I disable SSL compression because of CRIME?

ThreatPost: New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

ArsTechnica: Crack in Internet's foundation of trust allows HTTPS session hijacking

I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators.

As a web host, should I disable SSL compression because of CRIME?

ThreatPost: New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

ArsTechnica: Crack in Internet's foundation of trust allows HTTPS session hijacking

I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators.

As a web host, should I disable SSL compression because of CRIME?

ThreatPost: New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

ArsTechnica: Crack in Internet's foundation of trust allows HTTPS session hijacking

Tweeted twitter.com/#!/StackSecurity/status/246851176681857024
Source Link
Daniel Serodio
Daniel Serodio
  • 787
  • 2
  • 8
  • 14

Should I disable SSL compression because of CRIME?

I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators.

As a web host, should I disable SSL compression because of CRIME?

ThreatPost: New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

ArsTechnica: Crack in Internet's foundation of trust allows HTTPS session hijacking