The attacker needs to be able to compare the compressed HTTPS requests as they leave the victim's computer. Therefore, he needs to either be on the same open wireless network as the victim, be in control of the victim's home router or be on the same local area network as the victim, in which case other attack techniques like ARP spoofing can be used.

Session cookie values can be quite long and are made up of uppercase letters, lowercase letters and digits. As a result, the CRIME attack code has to initiate a very large number of requests in order to decrypt them, which can take several minutes.

However, the researchers have developed some algorithms that make the attack more efficient. "One of the CRIME algorithms makes less than 6 request to decrypt each byte. Sometimes 4 is enough, we can tune it," Rizzo .

Support for TLS compression among websites is pretty widespread. Forty-two percent of servers tracked by -- a project that monitors SSL/TLS implementations on the world's top 180,000 HTTPS-enabled websites -- support compression, Ivan Ristic, director of engineering at security vendor Qualys, said Thursday.

However, the level of support for TLS or SPDY compression is not very good on the client side, Ristic said. One source of data suggested that 10 percent of clients support TLS compression, he said.