HTTP Encrypted Information can be Stolen through TCP-windows [pdf]

Ars Technica summary: http://arstechnica.com/security/2016/08/new-attack-steals-ss... (A bit breathless.)