SPDY has been implemented in Google Chrome and Firefox and is supported by several popular websites including Google search, Gmail and Twitter.

CRIME decrypts HTTPS cookies set by websites to remember authenticated users by means of brute force. The attack code forces the victim's browser to send specially crafted HTTPS requests to a targeted website and analyzes the variation in their length after they've been compressed in order to determine the value of the victim's session cookie.

This is possible because SSL/TLS and SPDY use a compression algorithm called DEFLATE, which eliminates duplicate strings.

For example, if we generate a request that contains a "cookie = 123" string and a "cookie = 456" string and then we compress it with DEFLATE, the compression algorithm will replace the "cookie =" part from the second string with a small token that points to the location of the "cookie =" part from the first string. This will result in a smaller request.

If we then generate another request but with "cookie = 556" instead of "cookie = 456," the compression algorithm will again replace "cookie =" because it matches the identical part from the existing "cookie = 123" string. This will result in a compressed request that is almost identical in length to the first one.