of the CRIME attack against HTTP compression, dubbed BREACH, was published. A BREACH attack can extract login tokens, email addresses or other sensitive information from TLS encrypted web traffic in as little as 30 seconds (depending on the number of bytes to be extracted), provided the attacker tricks the victim into visiting a malicious web link. All versions of TLS and SSL are at risk from BREACH regardless of the encryption algorithm or cipher used. Unlike previous instances of CRIME, which can be successfully defended against by turning off TLS compression or SPDY header compression, BREACH exploits HTTP compression which cannot realistically be turned off, as virtually all web servers rely upon it to improve data transmission speeds for users. As of 2016, the TIME attack and the HEIST attack are now public knowledge. References External links RFC 2616: Hypertext Transfer Protocol – HTTP/1.1 HTTP Content-Coding Values by Internet Assigned Numbers Authority Compression with lighttpd Coding Horror: HTTP Compression on IIS 6.0 Using HTTP Compression by Martin Brown of Server Watch Using HTTP Compression in PHP Dynamic and static HTTP compression with Apache httpd Web development Lossless compression algorithms Hypertext Transfer Protocol de:Hypertext Transfer Protocol#HTTP-Kompression