News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?. Parent comment

Re:Google disables compression for OpenSSL in Chrome - SSL e... by tlb on Wednesday September 12, 2012 @12:04PM (#4511299)
You'd have the same problem if HTTP supported compression of the request headers & body. It's because it only supports compression of the response body that there isn't any leakage already.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by caf on Wednesday September 12, 2012 @10:29PM (#4514475)
This is true, but it reinforces why the compression should not be done at the secure transport layer, and should instead be left to higher levels: only HTTP knows which parts of the request are potentially unsafe to include in the same compression state.

(Even if HTTP probably just got lucky here rather than deliberately making the right choice, it's still the only layer that had the chance to make the right choice).

[ Parent | on HN ]