也是一個禮拜前的消息，在 Slashdot 上看到對 HTTPS 的新攻擊，目前沒有好解法，NSA 應該開心到爆炸：「BREACH Compression Attack Steals SSL Secrets」。
說明可以參考「Vulnerability Note VU#987798 BREACH vulnerability in compressed HTTPS」這篇。
假設你的 ISP 想要抓出你的 Facebook (HTTPS) session id 或是 CSRF token (只要是有能力在中間攔截封包並修改資料的團體都可以，這邊以 ISP 為例)，作法是針對 HTTP 頁面值入 script，讓你的瀏覽器對 https://www.facebook.com/ 發出大量 request，藉由觀察這些 HTTPS 的長度就有機會取得 session id (或 CSRF token)...
CERT 的 security advisory 上是寫：
With a token of length 32 and a character space of size 16 (e.g. hex), the attacker needs an average of approximately 1,000 request if no recovery mechanisms are needed. In practice, we have been able to recover CSRF tokens with fewer than 4,000 requests. A browser like Google Chrome or Internet Explorer is able to issue this number of requests in under 30 seconds, including callbacks to the attacker command & control center.
四千次就搞定了... 太！歡！樂！了！