In 2012 CRIME attack effectively killed TLS compression. Has anything changed since 2012 regarding compression in TLS or have modern browsers sacrificed security over performance? If browsers now use TLS compression how does it bypass CRIME/BREACH?
TLS compression is removed in TLS 1.3. And even for lower TLS versions it is no longer available in the browsers and disabled by default in OpenSSL. Note though that compression at the TLS level is only relevant for the CRIME attack, BREACH is instead about compression at the HTTP level. Thus BREACH is not mitigated by disabling TLS compression.