[google-appengine] Re: BREACH attack - is App Engine vulnerable?

2013-08-07 Thread Alex Burgel
On Wednesday, August 7, 2013 3:26:29 PM UTC-4, Chad Vincent wrote: > I'm with the person from Iron Mountain... Just like CRIME, they both seem > to require some kind of XSS vulnerability in the page, then take advantage > of TLS and GZIP. As long as your users don't use a lot of suspicious >

[google-appengine] Re: BREACH attack - is App Engine vulnerable?

2013-08-07 Thread Chad Vincent
I'm with the person from Iron Mountain... Just like CRIME, they both seem to require some kind of XSS vulnerability in the page, then take advantage of TLS and GZIP. As long as your users don't use a lot of suspicious add-ons and you prevent XSS as best as you can, I really don't think there'

[google-appengine] Re: BREACH attack - is App Engine vulnerable?

2013-08-06 Thread Iron Mountain Foundry
I'm not from Google, but this seems a little to slick of a presentation. They already have a glossy website with a custom domain name, complete with bios on the authors. Just because it's associated with BlackHat doesn't mean it's a class 1 emergency. Reading up on the details shows that it'