19
votes
To avoid BREACH, can we use gzip on non-token responses?
I'm answering my own question because I think I now understand BREACH and how to prevent it. I'd love feedback.
How BREACH works (as I understand it)
(Expanding on an explanation here that helped me....
- 2,624
17
votes
Is gzipping content via TLS allowed?
I read that this should be avoided because of CRIME/BREACH attack, is this correct?
It depends.
The CRIME attack is already mitigated in current browsers in that they don't use TLS compression and ...
- 183k
12
votes
Accepted
Brotli compression algorithm and BREACH attack
I thought this was quite an interesting question and problem, so I had a go at implementing the attacks myself, but against something other than "true" or "false".
To make things simple I used a ...
- 132k
6
votes
Accepted
is g-zipping assets a security concern?
I've been pondering this and I don't think your networking department is justified in this opinion. It does all depend on your threat model, but given the threat model of "hacked content to slip ...
- 123k
2
votes
Is gzipping content via TLS allowed?
gzipping SSL-encrypted data eliminates the advantages of SSL to some extent. Yes, gzipping ALL content might opens your website up to the BREACH-vulnerability.
But you can still add some resources ...
- 71
2
votes
Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?
The uncompressed size of each file is stored in the file metadata for no reason other than allowing an application to know things like the compression ratio. It is not meant to be authoritative in any ...
- 64.1k
1
vote
is g-zipping assets a security concern?
This should not be a security concern on which you spend energy.
Maybe your client doesn't have any anti-virus. Maybe they have bad anti-virus. If their system is vulnerable to attack by a website ...
- 2,659
Only top scored, non community-wiki answers of a minimum length are eligible