News for hackers. Stuff that matters.

A comment on Crack in Internet's foundation of trust allows HTTPS session hijacking. Parent comment

Re:Crack in Internet's foundation of trust allows HTTPS sess... by thurn on Thursday September 13, 2012 @04:10PM (#4518300)
I'm not sure what motivates this comment... the issue at hand is certainly not a vulnerability in the SPDY protocol.
[ Parent | on HN ]
Re:Crack in Internet's foundation of trust allows HTTPS sess... by protobluffers on Thursday September 13, 2012 @04:28PM (#4518410)
"CRIME works only when both the browser and server support TLS compression or SPDY"

If it would make more sense, then s/protocol/implementation/g or whatever you need to do to make sense of this.

How ever you choose to frame it, the targets are TLS and SPDY.

[ Parent | on HN ]
Re:Crack in Internet's foundation of trust allows HTTPS sess... by tptacek on Thursday September 13, 2012 @04:46PM (#4518497)
Huh? SPDY uses TLS. The target is basically "web browsers".
[ Parent | on HN ]
Re:Crack in Internet's foundation of trust allows HTTPS sess... by anonymous on Thursday September 13, 2012 @05:21PM (#4518689)
"web browsers" that support TLS compression or SPDY (which uses TLS compression)

It's quite possible to use a browser that supports neither. Indeed I'm using one right now.

[ Parent | on HN ]
Re:Crack in Internet's foundation of trust allows HTTPS sess... by newman314 on Friday September 14, 2012 @02:25AM (#4520342)
Does the SPDY spec require TLS compression? IIRC, TLS is needed. Hence, SPDY+http compress+no TLS compression is workable, no? It's not ideal but would still work...
[ Parent | on HN ]