BREACH

cryptographysecurity

A 2013 variant of CRIME that targets HTTP response compression instead of TLS.

Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext works even without TLS compression by attacking gzip at the HTTP layer, inferring secrets reflected in compressed responses. Mitigations include masking tokens and disabling reflection of user input.

Also known as: BREACH, Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext

← All glossary entries