Hot answers tagged

19 votes

To avoid BREACH, can we use gzip on non-token responses?

I'm answering my own question because I think I now understand BREACH and how to prevent it. I'd love feedback. How BREACH works (as I understand it) (Expanding on an explanation here that helped me....
user avatar
  • 2,624
17 votes

Is gzipping content via TLS allowed?

I read that this should be avoided because of CRIME/BREACH attack, is this correct? It depends. The CRIME attack is already mitigated in current browsers in that they don't use TLS compression and ...
user avatar
12 votes
Accepted

Brotli compression algorithm and BREACH attack

I thought this was quite an interesting question and problem, so I had a go at implementing the attacks myself, but against something other than "true" or "false". To make things simple I used a ...
user avatar
  • 132k
6 votes
Accepted

is g-zipping assets a security concern?

I've been pondering this and I don't think your networking department is justified in this opinion. It does all depend on your threat model, but given the threat model of "hacked content to slip ...
user avatar
  • 123k
2 votes

Is gzipping content via TLS allowed?

gzipping SSL-encrypted data eliminates the advantages of SSL to some extent. Yes, gzipping ALL content might opens your website up to the BREACH-vulnerability. But you can still add some resources ...
user avatar
  • 71
2 votes

Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?

The uncompressed size of each file is stored in the file metadata for no reason other than allowing an application to know things like the compression ratio. It is not meant to be authoritative in any ...
user avatar
  • 64.1k
1 vote

is g-zipping assets a security concern?

This should not be a security concern on which you spend energy. Maybe your client doesn't have any anti-virus. Maybe they have bad anti-virus. If their system is vulnerable to attack by a website ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible