Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on From stolen laptop to inside the company network. Parent comment
There have been what’s called “compression oracle” attacks on SSL with compress then encrypt scheme, see CRIME
https://en.m.wikipedia.org/wiki/Oracle_attack
An attacker could inject known plaintext to an unknown source and observe the size of the ciphertext. If the size doesn’t change much, it means the chosen plaintext is correlated with the source. Several variants exist.
Compression is often not recommended in VPNs.
There are no comments on this comment yet.
There have been what’s called “compression oracle” attacks on SSL with compress then encrypt scheme, see CRIME
https://en.m.wikipedia.org/wiki/Oracle_attack
An attacker could inject known plaintext to an unknown source and observe the size of the ciphertext. If the size doesn’t change much, it means the chosen plaintext is correlated with the source. Several variants exist.
Compression is often not recommended in VPNs.