6 ms·
Adding a few random bytes to a response seems to be an easy fix and doesn't require compression being disabled.
by cryptic 13y ago
Adding a few random bytes to a response seems to be an easy fix and doesn't require compression being disabled.
- jmillikin 13y agoAdding a random amount of random bytes will not defeat the attack, it would only slightly increase the amount of time required by making the side channel noisier. Adding a fixed amount of random bytes will have no benefit at all.
- deleted 13y ago[deleted]
- beagle3 13y agoCan you quantify "slightly"?
- quizotic 13y agoNot following your assertion. Suppose the reported size was always a random epsilon larger than the actual size. Choose epsilon so that its small enough to benefit from compression and large enough to obscure the BREACH. Why doesn't that work?