The active version of this attack is totally worrying (deduplication between multiple user accounts, alice and eve). But the passive version above requires a p

The active version of this attack is totally worrying (deduplication between multiple user accounts, alice and eve). But the passive version above requires a privileged network position as well as an unrealistically good idea about what was in the original backup. I agree it's a weakness, but i'm not sure it's a cause for concern You might equally say something like "the amount of time taken to backup is a timing side-channel into the size of the deduplication cache", it's true but i don't think it immediately lead to any practical attacks. Can you elaborate on a scenario?