News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?. Parent comment

Re:Google disables compression for OpenSSL in Chrome - SSL e... by JoachimSchipper on Thursday September 13, 2012 @05:53AM (#4515403)
People do run HTTPS clients on AWS, though. Web APIs tend to [1] require exactly that.

[1] Lala people never send sensitive data over plain HTTP I'M NOT HEARING YOU.

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by Dylan16807 on Friday September 14, 2012 @12:24AM (#4520067)
Sure, they might use HTTPS, but how often do they load arbitrary pages with uncontrolled javascript?
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by JoachimSchipper on Friday September 14, 2012 @04:27AM (#4520736)
Pretty much never. How often do they make requests that are at least partially attacker-controlled, though? (Note that variants on https://www.someapi.com/...?username=foo contain attacker-controlled data...)
[ Parent | on HN ]