Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Would it be possible to just have some sort of dynamic compression scheme and not gzip when you'll potentially be transmitting sensitive information?


This. Suppose we could randomize Gzip levels differently in each response.


Randomizing Gzip levels (and random padding) only increases the number of samples you need to take.


We can also create one-time pads for tokens, so the number of samples will ramp up pretty so quickly which will make these kind of attack unfeasible.

And I guess we can tweak gzip Huffman tables so user inputs were poorly compressed compared to rest of the page content.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: