shazow/urllib3 — pull request #309 by dbrgn (2014-01-08 02:39:22+00:00)
Title: Disable TLS compression (CRIME)

Right now, urllib3 has SSL/TLS compression enabled by default:

```python
>>> import json
>>> import urllib3
>>> http = urllib3.PoolManager()
>>> r = http.request('GET', 'https://www.howsmyssl.com/a/check')
>>> data = json.loads(r.data.decode('utf8'))
>>> data['rating']
'Bad'
>>> data['tls_compression_supported']
True
```

SSL/TLS compression should be disabled by default to migitate the CRIME attack: https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls I tried to create a patch but did not find the right place in the codebase to do so.

Most browsers (if not all) have already disabled the compression (or never implemented it in the first place), but many client libraries like urllib3 still use it.