News for hackers. Stuff that matters.

A comment on Security advisory: Breach and Django. Parent comment

Re:Security advisory: Breach and Django by veesahni on Tuesday August 06, 2013 @10:38AM (#6166799)
I'm in the same boat - if the attacker could inject strings into requests pre-compression, then wouldn't the client already be compromised?
[ Parent | on HN ]
Re:Security advisory: Breach and Django by rlucas on Tuesday August 06, 2013 @10:52AM (#6166873)
No, you're missing that the original GET requests can be performed in some cases over HTTP, either by forgery or by surreptitiously spoofing the user's own browser into doing it. No need to have compromised the SSL/TLS.
[ Parent | on HN ]