Recently, I read a paper which describes an attack on http response protocol. The attack is called CRIME or CRIME Extensions. It exploits TLS compression algorithm by checking the total payload of http response after injecting some word into response message. As compression algorithm (DEFLATE in TLS) replaces same word into shorter length, the attacker can check if the injected word is the same with secret information in HTML response message.
Do HTML files have secret information? For example, in major websites such as Google or Facebook, after the TLS handshake, a client sends a HTTP request, like "send me my personal page", and the server sends a HTTP response that has very private information?