Crack in Internet's foundation of trust allows HTTPS session hijacking
So for this to work, an attacker needs to be a Man In The Middle, and get the attacked client to execute some malicious Javascript, which in turn crafts requests to a target site which uses TLS and SPDY. The MITM intercepts and compares the encrypted and compressed payload for recurring patterns that result when using DEFLATE. By playing with the crafted requests, he can e.g. guess cookie values that were added by the browser to the request (as many XSS attacks work) by comparing the lengths of the encrypted payloads.<p>See  <a href="http://security.blogoverflow.com/2012/09/how-can-you-protect-yourself-from-crime-beasts-successor/" rel="nofollow">http://security.blogoverflow.com/2012/09/how-can-you-protect...</a> for technical details.<p>This seems to be a very basic attack, wondering why this attack vector wasn't publicly known much earlier...