Hacker News new | ask | show | jobs
by cryptic 4697 days ago
Adding a few random bytes to a response seems to be an easy fix and doesn't require compression being disabled.
1 comments

Adding a random amount of random bytes will not defeat the attack, it would only slightly increase the amount of time required by making the side channel noisier.

Adding a fixed amount of random bytes will have no benefit at all.

Not following your assertion. Suppose the reported size was always a random epsilon larger than the actual size. Choose epsilon so that its small enough to benefit from compression and large enough to obscure the BREACH. Why doesn't that work?
Can you quantify "slightly"?