Disabling compression is a 100%-effective countermeasure for compression oracle attacks.

> Also, why does the site http://breachattack.com/ says that "Randomizing secrets per request" is less effective than disabling compression?

Putting random data in the server response will only slow down the attack. With enough requests, the noise from that random data will wash out.

Disabling compression will stop the attack cold. The whole thing is predicated on analyzing the size of the compressed text. No compression, no compression oracle.

I suppose, given infinite time, you could send the same request over & over and map the variance of content lengths, and get an idea of what the actual content length was before random padding? But the compression seems to throw that off even more AFAIK - because the data we pad with is random, it could very well accidentally compress well because of the rest of the data in the response, further throwing off any guesses.

Edit: From the pdf on breachattack.com:

  While this measure does make the attack take longer, it does so only slightly.
  The countermeasure requires the attacker to issue more requests, and measure the
  sizes of more responses, but not enough to make the attack infeasible. By repeating
  requests and averaging the sizes of the corresponding responses, the attacker can
  quickly learn the true length of the cipher text. This essentially boils down to the
  fact that the standard error of the mean in this case is inversely proportional to p
  N, where N is the number of repeat requests the attacker makes for each guess.

Attacker gets secret wrong, page is size: original page + (zero to fifty) + length of incorrect secret Attacker gets secret right, page is size: original page + (zero to fifty)

With a sufficiently high number of observations the attack with the right secret has a mean value that is lower than the attack with the incorrect secret.

At least that's what it appears to me. I could be wrong.

Yes, that's what I mentioned in my post. However, the way I understand "Randomizing secrets per request", it means sending new, random secrets with every request (i.e. generating a new CSRF token for every request).