News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?. Parent comment

Re:Google disables compression for OpenSSL in Chrome - SSL e... by tptacek on Wednesday September 12, 2012 @11:38AM (#4511135)
That's why sites need to enable the Secure flag on their cookies, and to set the Strict-Transport-Security headers.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by thatwonthelp on Wednesday September 12, 2012 @04:35PM (#4513052)
Won't help in this case.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by tptacek on Wednesday September 12, 2012 @04:46PM (#4513121)
I don't know what you're saying. If you're saying that the "Secure" flag won't defend against CRIME, nobody is saying that. I'm saying that the "Secure" flag and HSTS mitigates SSL-stripping.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by tlrobinson on Wednesday September 12, 2012 @07:04PM (#4513761)
I think both ivanr and thatwonthelp were suggesting that any non-secure site (same origin or not) can be hijacked in order to make the requests necessary for this attack.

I understand and agree with your comment about the secure flag, but if I understood ivanr's comment it doesn't apply.

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by bdr on Wednesday September 12, 2012 @05:20PM (#4513291)
Oddly, GP's account was made for the purpose of writing that comment. I'm unsure what that means.
[ Parent | on HN ]