13

For example when I have a look on the HTTP header of https://www.facebook.com I see that they utilize GZIP compression Content-Encoding: gzip with SSL/TLS traffic.

Isn't that a bad idea because of BREACH/CRIME attack?

curl -I -H 'Accept-Encoding: gzip,deflate' https://www.facebook.com
HTTP/1.1 200 OK
Pragma: no-cache
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Strict-Transport-Security: max-age=15552000; preload
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 15 May 2015 18:56:11 GMT
Connection: keep-alive
Content-Length: 15101

According to http://en.wikipedia.org/wiki/BREACH_%28security_exploit%29

1

1 Answer 1

16

BREACH exists when you have TLS plus HTTP compression (ie gzip). But it also requires:

  1. useful, secret information in the response body
  2. attacker must be able to inject a value into the response body with a request parameter
  3. no random response padding

Comments:

  1. Hackers are after credit card numbers, passwords, CSRF tokens, and probably not chats with your GF, but you never know.

  2. It looks like a lot of the input responses (search bar at top, for example) are out-of-band, ie the response is over AJAX so doesn't affect other responses.

  3. Facebook might be padding their responses, but I haven't delved too deeply into that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.