3 ms·
If the link layer knows that the encrypted bits are actually transporting video, then an attacker might have an easier time decrypting the traffic.
by eptcyka 5y ago
If the link layer knows that the encrypted bits are actually transporting video, then an attacker might have an easier time decrypting the traffic.
- wizzwizz4 5y agoPerhaps – but well-compressed video is hard to distinguish from noise. You should already be assuming the attacker knows that kind of thing; googlevideo.com doesn't serve much other than video, for example.
- salawat 5y agoNo. That's implying your hardware has knowledge of cultural or human constructs. Your ascribing a set of qualities to a hunk of silicon you darn well have no business doing. Besides which, say googlevideo.cim flubs the Domain renewal and I snap it up and start serving a Slackware mirror for instance. The Stack below the application layer should neither care nor assume anything other than "take this, send here" with maybe some wiggle room where I have the option to tell it "best effort is okay" or "make it reliable". Anything else is biasing certain uses for certain endpoints, which strikes me as digital fiefdom carving. No thanks. Dumb pipes, generously provisioned, thank you very much.
- fennecfoxen 5y ago> No. That's implying your hardware has knowledge of cultural or human constructs. Once upon a time I was working at a startup which pivoted slightly from generic "store analytics" to a product which mirrored the wifi network's uplink to a server where we would do deep packet inspection and watch you price-compare on Amazon (at the time, checkout was encrypted, but browsing and Add to Cart were unencrypted, and Amazon was offering discounts for price-comparing in store.) It was alluded to in the wifi network privacy policy that you didn't read. I understand that, in the days since I got creeped out and left, several hardware vendors have since added support in their equipment to facilitate the operation of these analytics. We are fortunate that so much more is encrypted today, but pay heed! You must assume that hardware participates in a system that knows about human constructs, in all the most adversarial ways possible.
- salawat 5y agoYou know, I die a bit inside everytime I find something like this out. This is why we can't have nice things. However... This is still markedly different than baking in heuristic, application specific optimizations into the hardware transport and lower levels. At that point, who sends what where should be a foregone conclusion. No hardware manufacturer should even be thinking of accommodating this niche case or that. I mean, they are free to, but everything I've seen says that isn't the best idea. Leave it to the Application layer to optimize.
- rdtwo 5y agoI wish someone would use that data and actually price match amazon. I hate trying to buy non counterfeit items on the vendor site only to b find out that they are 20-30% more after after shipping. Usally I give up at that point out risk amazon counterfeit.
- Sohcahtoa82 5y agoThis isn't true. Good encryption makes it impossible to derive the decryption key even if you have a large selection of the plaintext. Otherwise, an attacker could decrypt web traffic, knowing that a lot of the data is ASCII text.
- eptcyka 5y agoAll encryption is good until it's not.