Questions tagged [gzip]
Gzip is a software application/method used to compress data. Gzip is acronym for GNU zip. Gzip is based on DEFLATE algorithm, a combination of LZ77 a Huffman coding.
6
questions
0
votes
1
answer
73
views
CRIME like attack and locality of randomized data
I am not an information security expert (just a developer) and recently discovered this kind of vulnerability, and have a few questions (so sorry if I misinterpreted something about how the attack ...
- 103
13
votes
1
answer
8k
views
To avoid BREACH, can we use gzip on non-token responses?
I work on a site that has a web interface an an API. I'm trying to determine if we can safely use gzip, or if that will open us to BREACH.
The site says:
If you have an HTTP response body that meets ...
- 2,724
20
votes
1
answer
3k
views
Brotli compression algorithm and BREACH attack
I spent a lot of time on BREACH attack implementations. In theory, Brotli compression, like other compressions that use lzz7 family algorithms, must be vulnerable to the BREACH attack.
Experiences ...
4
votes
1
answer
433
views
Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?
Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as ...
- 141
3
votes
3
answers
220
views
is g-zipping assets a security concern?
I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website.
I brought this to the attention of the networking ...
- 187
18
votes
3
answers
12k
views
Is gzipping content via TLS allowed?
So I have these few compression directives at http level in nginx:
gzip on;
gzip_http_version 1.1;
gzip_vary on;
I read that this should be avoided because of CRIME/BREACH attack, is this correct?
- 1,073