Sorry, but this is ridiculously bad. So the point here is that they say QUIC doesn't do length hiding. Okay. This is not a secret, but okay, you can point that

Sorry, but this is ridiculously bad. So the point here is that they say QUIC doesn't do length hiding. Okay. This is not a secret, but okay, you can point that out. However then they go on that they don't know (because they haven't checked) whether the same is true for TLS. It is. It's been published as the HTTPS Bicycle attack. Writing "we strongly encourage other researchers to study TLS version 1.2 to see if Ring-Road exists" is comical under this circumstances. The university's press release tries to spin this as a google bug: https://www.cerias.purdue.edu/site/blog/post/purdue_cerias_researchers_find_vulnerability_in_google_protocol/ https://www.cerias.purdue.edu/site/blog/post/purdue_cerias_r... Which is... quite a stretch, given that QUIC just has the very same behavior as TLS. It almost makes you think they haven't checked TLS to be able to spin this as a "google vuln" story. Then they recommend to disable QUIC. Which will do... nothing to mitigate this vuln, because of course the browser will just fall back to normal HTTPS with TLS - which has the same vuln, but hey, they haven't checked.