The only part you're wrong about is the compression on TLS part, it's not an 'and':
> While CRIME was mitigated by disabling TLS/SPDY compression (and by modifying
> gzip to allow for explicit separation of compression contexts in SPDY),
> BREACH attacks HTTP responses. These are compressed using the common HTTP
> compression, which is much more common than TLS-level compression. This
> allows essentially the same attack demonstrated by Duong and Rizzo, but
> without relying on TLS-level compression (as they anticipated).
and
> It is important to note that the attack is agnostic to the version of
> TLS/SSL, and _does not require TLS-layer compression._
