Subject: [hybi] Consideration about CRIME like attacks against WebSocket

From: Takeshi Yoshino <[email-masked]>
Date: Tue, 21 Jan 2014 13:19:55 +0900

As announced, Chrome 32 supports permessage-deflate.

We consider that the extension won't help leak any information such as
cookie string in the opening handshake since only payload data is subject
to compression, and so CRIME won't work for permessage-deflate.

However, as new CRIME like attacks such as BREACH were discovered in last
year, it's not impossible that new exploits based on length information
that affect WebSocket will be revealed. Please keep your eyes on findings
from security researches.

Re: possible BREACH variant for WebSocket, you just need to make sure you
don't respond with any sensitive info to WebSocket with an unknown Origin
value.