Did you know? Compressing a secret alongside attacker-controlled text can betray it even over HTTPS. BREACH, demonstrated in 2013, used changes in compressed response size to recover secrets such as CSRF tokens from vulnerable pages. The attacker measures encrypted traffic lengths across repeated requests; TLS itself does not need to be broken. Encryption hides the text, but compression can turn its size into feedback on a guess. #privacy #cryptography