Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of tom.browder@gmail.com
 designates 209.85.212.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAKUrXK4nWHdi_a6u4SiN4ubSZ9TNqr2yO-3Mh+nBvecAh6M8Gw@mail.gmail.com>
References: 
 <CAFMGiz_1F5MPj+DSEHoLSR-t6=nbHDF56jrnVee5UyP9azSsvQ@mail.gmail.com>
 <CAFMGiz9q=q84fDVNoXTco6zHgbwbVocEwtAaee8=66gsN1PJJg@mail.gmail.com>
 <CAKUrXK4nWHdi_a6u4SiN4ubSZ9TNqr2yO-3Mh+nBvecAh6M8Gw@mail.gmail.com>
From: Tom Browder <tom.browder@gmail.com>
Date: Fri, 6 Jun 2014 10:35:09 -0500
Message-ID: 
 <CAFMGiz9_0uqs7XZ35HQxMog17hX8aUepmZQYF72jfgNEjQtYTA@mail.gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [users] Re: Recommended practice for mitigating BREACH/CRIME
 attacks with Apache 2.4+, SSL/TLS-only sites, and use of mod_deflate?

On Fri, Jun 6, 2014 at 10:16 AM, Jeff Trawick <trawick@gmail.com> wrote:
>> On Tue, Jun 3, 2014 at 3:52 PM, Tom Browder <tom.browder@gmail.com> wrot=
e:
>> > I have several SSL/TLS-only virtual sites running under Apache 2.4.7.
>> > I haven't turned on compression because of all the warnings about
>> > CRIME and BREACH.  However, when I run my sites against web site
>> > analyzers they always suggest turning on compression.
>> >
>> > So what is the consensus?
...
> I think the free "OpenSSL cookbook" part of Ivan Risti=C4=87's guide addr=
esses
> some of your question.  There's also an Apache-specific chapter of the bi=
g
> book which I haven't looked at.

Thanks, Jeff--I forgot about Ivan's book!

Best regards,

-Tom

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org