The only part you're wrong about is the compression on TLS part, it's not an 'and':

  > While CRIME was mitigated by disabling TLS/SPDY compression (and by modifying
  > gzip to allow for explicit separation of compression contexts in SPDY),
  > BREACH attacks HTTP responses. These are compressed using the common HTTP
  > compression, which is much more common than TLS-level compression. This
  > allows essentially the same attack demonstrated by Duong and Rizzo, but
  > without relying on TLS-level compression (as they anticipated).

and

  > It is important to note that the attack is agnostic to the version of
  > TLS/SSL, and _does not require TLS-layer compression._

breachattack.com