> Yeah, but that's a pretty obscure attack. I'm certain nation states work on developing these attacks. Also a commercial company just has to build it once, th

> Yeah, but that's a pretty obscure attack. I'm certain nation states work on developing these attacks. Also a commercial company just has to build it once, then they can sell it to ISPs who make money selling your data. > All bank customers have the same length account number. This isn't the only problem with packet size data, there have been compression attacks that can recover plaintext using packet sizes, like CRIME and BREACH. > All the videos on YouTube have the same length identifier and usually last about 10 minutes and 1 second Here's a research paper from 2017 where someone in a MITM position could detect exactly what netflix video you were watching by looking at packet sizes: https://mjkranch.com/docs/pubs/CODASPY17_Kranch_Reed_IdentifyingHTTPSNetflix.pdf https://mjkranch.com/docs/pubs/CODASPY17_Kranch_Reed_Identif... Of course TLS still provides a critical level of security and privacy, but there is room for improvement.