3 ms·
No, and it doesn't protect the privacy of the viewer either!
by nextgens 4y ago
No, and it doesn't protect the privacy of the viewer either!
- saurik 4y agoFWIW, neither does the TLS layer: because the video is all chunked into fixed-time-length segments, each video causes a unique signature of variable-byte-size segments, making it possible to determine which Netflix movie someone is watching based simply on their (encrypted) traffic pattern. Someone built this for YouTube a while back and managed to get it up to like 98% accuracy. https://www.blackhat.com/docs/eu-16/materials/eu-16-Dubin-I-Know-What-You-Saw-Last-Minute-The-Chrome-Browser-Case.pdf https://www.blackhat.com/docs/eu-16/materials/eu-16-Dubin-I-... https://americansforbgu.org/hackers-can-see-what-youtube-videos-you-watch/ https://americansforbgu.org/hackers-can-see-what-youtube-vid...
- nightpool 4y agoDid TLS 1.3 fix this with content length hiding? Doesn't it add support for variable-length padding that could prevent the attacker from measuring the plaintext content length? Do any major servers support it?