Subject: Re: [http-auth] CRIME to Basic or Bearer Tokens

From: "KIHARA, Boku" <[email-masked]>
Date: Thu, 4 Oct 2012 14:26:57 +0900

2012/9/27 Tom Ritter <[email-masked]>:
> On 27 September 2012 06:26, KIHARA, Boku <[email-masked]> wrote:
>> When I read summaries of the CRIME for TLS, I suspect that this attack
>> can be applied to HTTP Basic authentication and other bearer-token-type
>> authentication schemes because browsers send the Authorization header
>> field automatically. Is my thought right?
>
> Yes.

Thank you.
I have experimented briefly on CRIME attack to Basic and succeeded to
steal the password of the experiment environment.

Regards,
Boku Kihara