News for hackers. Stuff that matters.

A comment on New attack plucks secrets from HTTPS-protected pages.

Re:New attack plucks secrets from HTTPS-protected pages by eli on Thursday August 01, 2013 @12:19PM (#6141346)
Cute attack -- takes advantage of the deflate compression shrinking the size of repetitive strings as a way to test if a given set of bytes is in the encrypted data.

Has nothing to do with email addresses. That was just an illustration.

[ Parent | on HN ]
Re:New attack plucks secrets from HTTPS-protected pages by tracker1 on Thursday August 01, 2013 @01:20PM (#6141860)
I think it is definitely interesting, if you can test for a string for encoded data, either form encoded `&key={GOLD}&nextkey=` or json encoded `"key":"{GOLD}","nextkey"` you can get to almost anything.
[ Parent | on HN ]
Re:New attack plucks secrets from HTTPS-protected pages by lnanek2 on Thursday August 01, 2013 @12:48PM (#6141602)
Their other illustration wasn't terribly useful either, though, request_token. That's supposed to change each time the form is generated and meanwhile this attack takes thousands of runs against the server...
[ Parent | on HN ]