2
$\begingroup$

I was reading this article and had a question....

http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/

As I understand it TLS/SSL work in such a way that even the Requested URL is encrypted. So, my question is...would it be possible to create an SSL proxy that could use BREACH to figure out the requested url from the encrypted response?

$\endgroup$
  • $\begingroup$ These attacks require the adversary to take partial control over the client browser. Since client side scripting allows the malicious script to make the client browser to send requests the script partially controls, the adversary might analyze the resulting cipher text and draw conclusions regarding the parts of the plain text that are unknown. Controlling just a SSL proxy is not enough. $\endgroup$ – Henrick Hellström Aug 2 '13 at 0:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.