Subject: [http-auth] CRIME to Basic or Bearer Tokens

From: "KIHARA, Boku" <[email-masked]>
Date: Thu, 27 Sep 2012 19:26:45 +0900

Hello,

When I read summaries of the CRIME for TLS, I suspect that this attack
can be applied to HTTP Basic authentication and other bearer-token-type
authentication schemes because browsers send the Authorization header
field automatically. Is my thought right?

Regards,
Boku Kihara

---

From: Tom Ritter <[email-masked]>
Date: Thu, 27 Sep 2012 07:12:12 -0400

> field automatically. Is my thought right?

Yes.

-tom