News for hackers. Stuff that matters.

A comment on Architecting Websites for the HTTP/2 Era. Parent comment

Re:Architecting Websites for the HTTP/2 Era by nine_k on Tuesday May 12, 2015 @03:57PM (#9534431)
The attack depends on a secret to match a user-provided string enough for the compression algorithm to notice this redundancy?

A counter-measure then would be to scramble the user input in the page with a random key, and include this key into the page for de-scrambling using JavaScript. It will still efficiently compress the parts of the page which are not user-controlled.

[ Parent | on HN ]
Re:Architecting Websites for the HTTP/2 Era by strommen on Tuesday May 12, 2015 @05:24PM (#9535002)
Yes and Yes (assuming your random key isn't guessable).

breachattack.com suggests masking the secret with a per-request random key, but masking the user input would work too.

[ Parent | on HN ]
Re:Architecting Websites for the HTTP/2 Era by nickysielicki on Tuesday May 12, 2015 @05:14PM (#9534935)
> de-scrambling using JavaScript

No thank you.

[ Parent | on HN ]