This attack is on HTTP compression, which covers only the body of the request, not the headers [1].

1. http://en.wikipedia.org/wiki/Http_compression

Yeah, so you'll have to be able to write to, but not read, the body of the request, observe the ciphertext on the wire and guess things in the body only. So this is only good for CSRF tokens and the like, and only if you can write to the plaintext you want to guess but not just outright read it.

The attack builds on the CRIME attack, which is discussed in more technical detail here:

http://zoompf.com/2012/09/explaining-the-crime-weakness-in-s...

That page suggests that guessing known text like an SSN or email address contained in the body would give them an opening to break the encryption entirely, but I don't know enough about crypto to know if that's actually a possibility.

I guess I thought they were guessing the POST data from a login form -but I see what you are saying. The POST request in URL encoded form or multi-part form data is not compressed anyway, only the response is affected by deflate. So I am curious too, how a password would be in the gzip dictionary, since it should never be sent back to the browser in compressed form.