News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?. Parent comment

Re:Google disables compression for OpenSSL in Chrome - SSL e... by JoachimSchipper on Wednesday September 12, 2012 @01:54PM (#4511931)
> You better have an extremely low jitter connection!

Like AWS. (Cite: http://dl.acm.org/citation.cfm?id=1653687.)

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by __alexs on Wednesday September 12, 2012 @02:11PM (#4512060)
I doubt youd even have to break SSL using that attack. Lots of people do SSL termination at the load balancer.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by Dylan16807 on Wednesday September 12, 2012 @06:08PM (#4513515)
Okay, but people don't run web browsers on AWS.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by abadidea on Wednesday September 12, 2012 @07:47PM (#4513930)
except when they do! http://www.amazon.com/gp/help/customer/display.html/?nodeId=...
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by Dylan16807 on Friday September 14, 2012 @12:24AM (#4520064)
Doesn't do HTTPS, also I am skeptical of cross-site javascript shenanigans happening on the server-end of silk.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by JoachimSchipper on Thursday September 13, 2012 @05:53AM (#4515403)
People do run HTTPS clients on AWS, though. Web APIs tend to [1] require exactly that.

[1] Lala people never send sensitive data over plain HTTP I'M NOT HEARING YOU.

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by Dylan16807 on Friday September 14, 2012 @12:24AM (#4520067)
Sure, they might use HTTPS, but how often do they load arbitrary pages with uncontrolled javascript?
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by JoachimSchipper on Friday September 14, 2012 @04:27AM (#4520736)
Pretty much never. How often do they make requests that are at least partially attacker-controlled, though? (Note that variants on https://www.someapi.com/...?username=foo contain attacker-controlled data...)
[ Parent | on HN ]