Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

AFAICT this only avoids CRIME if there's never both attacker-controlled data and a secret in the same SLZ compress call.


But I think the idea is that the compress call takes such a small amount of data that it is far less likely for there to be such data in the same call


It goes beyond that, and suggests explicitly dividing up the data into sensitive and potentially attacker-controlled pieces, and processing those pieces separately. In short (and I could be wrong, but this seems to be the basic idea), if you always start a new chunk after you're done sending headers and before you start sending content, you're safe.


You can separate the calls while keeping the streams intact.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: