5 ms·
There’s fast.com and speed.cloudflare.com to get realistic speed measurements since there’s no way* the ISP can tell traffic to these sites vs. video traffic to
by supriyo-biswas 3y ago
There’s fast.com and speed.cloudflare.com to get realistic speed measurements since there’s no way* the ISP can tell traffic to these sites vs. video traffic to Netflix/Cloudflare.
*Technically some ISPs can (and probably do) look at the ServerNameIndication to determine hostname and therefore whether they’re video flows or not, but I’ve not heard any real world examples of this being done.
- paulryanrogers 3y agoESNI to the rescue?
- cesarb 3y ago> ESNI to the rescue? IIRC, it's now called ECH, because AFAIK the focus changed from "encrypt the SNI" to "encrypt the whole Client Hello".
- crotchfire 3y agoUh, no, the focus changed to don't encrypt the outer SNI but pretend we're encrypting something that will prevent filtering, even though it won't.
- infotogivenm 3y agoCan you elaborate? I have not kept up with the eSNI/ECH stuff... How will filtering still be possible?
- lxgr 3y agoIsn't the outer SNI something that can be deduced from the IP address anyway?
- jacooper 3y agoDo you have more details on that ?
- avipars 3y agoComputer Scientists pick the best names for things
- bsoft16385 3y agoModern deep packet identification gear looks at packet size and pacing to distinguish video traffic patterns. It is possible to fool these systems, but it is not trivial.
- Waterluvian 3y agoAny reason fast.com couldn’t stream a video as the test content?
- pests 3y agoI think it does pull a real video, I'm not sure its pulled in the same way the actual Netflix video player would do it.
- tuetuopay 3y agoyou wouldn't pull at gigabits/s bandwidth when casually watching netflix
- londons_explore 3y agodunno about netflix, but youtube usually does. They send you a chunk of data as fast as possible, and then send nothing till your client requests the next chunk. By doing that, they can get a good estimate of your connections available bandwidth, which is needed for the decision whether to automatically switch to a higher/lower quality feed. It also means they can use 'dumb' servers which don't do any application-specific logic for throttling.
- tuetuopay 3y agomakes sense, but in that case it's quite easy to distinguish between a burst of traffic of <1s to a speedtest that last tens of seconds
- chatmasta 3y agoRecently I've noticed my phone disconnecting from my Wi-Fi router (a relatively underpowered device running OpenWRT and WireGuard) when starting YouTube videos. I guess this could explain it, if the router is hiccuping on that initial blast of data. I also use a Safari extension that lets me choose the YouTube video quality, so that might affect it if I'm not giving the feedback they expect for "auto" quality selection. (The issue is not the router, though - this doesn't happen on my laptop. I think my phone is just more aggressive in assuming the Wi-Fi is down and it's better to switch to cellular. But couple that with my phone's policy to use VPN on cellular, and the switch becomes much higher friction. I tried simply disabling cellular data, but then it's even worse because every time the phone disconnects from Wi-Fi it pops an alert telling me to enable cellular data.)
- crotchfire 3y agoAre you kidding? Snooping like this is EXACTLY why we still have unencrypted ServerNameIndication, even to this day in ECH (which still leaves the outer SNI in the clear).
- lxgr 3y agoWhat does the outer SNI tell a hypothetical filtering/traffic shaping ISP that the IP address doesn't already?
- deleted 3y ago[deleted]
- londons_explore 3y agolots of sites often just are connections to cloudflare/akami/fastly these days. Ie. one IP, millions of websites. The ISP/feds need SNI to tell what you're up to.
- lxgr 3y agoYes, but the outer SNI (with ECH) in that case would just say "Cloudflare", "Akamai" etc., if I understand it correctly.