News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?. Parent comment

Re:Google disables compression for OpenSSL in Chrome - SSL e... by amalcon on Wednesday September 12, 2012 @12:12PM (#4511345)
Interesting. The attacker would also need to push the request size up to the next block boundary, but it should work.

At least we can still do compression at the HTTP (or other higher-level protocol) level. That gets us most of the benefit anyway.

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by __alexs on Wednesday September 12, 2012 @12:44PM (#4511553)
I suspect most TLS libraries will flush the compression buffer after each write call so its highly likely that every request will end on a deflate block boundary already.
[ Parent | on HN ]