You still don't understand. While the average time length of a YouTube video might be 10m1s, the time length of a specific video isn't. Worse, the file sizes ar

You still don't understand. While the average time length of a YouTube video might be 10m1s, the time length of a specific video isn't. Worse, the file sizes are all quite different even if the time length is the same due to video compression. The way these sites work is you download segments of the video of fixed time length (such as two seconds), roughly in order, and so it becomes trivial to fingerprint which video you are watching by what sequence of specific file sizes someone downloads. This is absolutely not an "obscure" attack: it has been used, successfully, to build a tool to guess what city you are looking at with Google Maps. There, tiles are downloaded to render a map (similar to the segments used to render a video on YouTube). While each tile may have a fixed dimension, again, due to image compression, each tile has a different file size. Since tiles are downloaded in clusters, you can pretty readily fingerprint different regions of the map a user is looking at (and if it weren't for local caching, it would work almost instantly 100% of the time, live). With type-ahead searching, as each character you type returns a different list, given the file size response sequence you should be able to determine exactly what search query someone made with almost total accuracy almost all of the time when they type it, with the only reason it ever not working well being due to caches and delayed queries (if you type fast enough on many type-ahead query boxes it will avoid sending queries for the prefixes, to reduce load for something that by the time the result is fetched won't even render).