HTTP"not?"S

[Yevrag35]

HTTPS now hackable in under 30 seconds: HTTPS Hackable In 30 Seconds: DHS Alert - Security - Attacks/breaches

The perp still has to be already inside the local network, but this really underscores the importance for businesses and institutions to setup stringent policies that restrict non-essential user access to local resources.

 

[office politics]

Vulnerability Note VU#987798 - BREACH vulnerability in compressed HTTPS


Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds.





Some of these mitigations may protect entire applications, while others may only protect individual web pages.
•Disable HTTP compression.
•Separate the secrets from the user input.
•Randomize the secrets in each client request.
•Mask secrets (effectively randomizing by XORing with a random secret per request).
•Protect web pages from CSRF attacks.
•Obfuscate the length of web responses by adding random amounts of arbitrary bytes.