New attack plucks secrets from HTTPS-protected pages
This isn't going to be useful to malware writers. People who can <i>not</i> install malware on a machine may be able to use this to extract sensitive information.<p>The hackiest fix for this is to randomize the output of your content, or employ random padding. If the compression payload size changes every time (<i>and</i> if you can no longer assume the structure of the payload) you can't effectively determine if a guess was right or wrong.