Re:New attack plucks secrets from HTTPS-protected pages
by citrin_ru on Thursday August 01, 2013 @04:52PM
(#6143453)
It seems to be <!-- small random string with random length --> in html sent by server, will be useful to protect from this attack. Length of response will be always different, and this difference can't be guessed by attacker.
[ Parent
| on HN ]
Re:New attack plucks secrets from HTTPS-protected pages
by lmkg on Thursday August 01, 2013 @08:11PM
(#6144573)
Like adding jitter to try and disrupt timing attacks, this increases the cost to the attacker but does not actually prevent the attack. If you send [email protected] a couple of times, you will get an average length. No matter how much noise, send it enough times and you can get statistical confidence in the average length.
There's also the issue that adding random incompressable junk to your packets sort of defeats the point of compressing them in the first place.