Hacker News new | ask | show | jobs
by e12e 3666 days ago
CRIME allows for the recovery of certain parts of the cipher text, by sending many requests. I don't see an easy way to use it to apply it to xmpp (or imap).

In https, it is possible to enumerate certain headers, or other predictable data - session cookies in particular. How would you leverage the use of compression to attack xmpp?
1 comments
Zash 3666 days ago
Not easy, but it can be applied to XMPP: https://blog.thijsalkema.de/blog/2014/08/07/https-attacks-an...
link
e12e 3665 days ago
Interesting. Perhaps digest auth should make a comeback with tls.

[and rate-limiting logins, obviously, as well as 2fa etc]

link