3 ms·
I'm not disagreeing with you, but HTTPS is irrelevant if a motivated adversary can detect that you've downloaded 5GB over the past 5 minutes from https://www.ex
by politician 12y ago
I'm not disagreeing with you, but HTTPS is irrelevant if a motivated adversary can detect that you've downloaded 5GB over the past 5 minutes from https://www.example.com/disney-frozen-0day-full-length https://www.example.com/disney-frozen-0day-full-length. Without additional protocols, encrypted channels are still subject to traffic analysis.
- paulannesley 12y agoThey'll only see 5GB from www.example.com:443, the request path is protected by HTTPS. With some kind of DNS security they'd only see 5GB from 12.23.34.45:443.
- zaroth 12y agoThe IP is well know so I'm not sure I follow the point about DNS. Also note it's not that they see 'about 5GB' but the size of every packet and exactly when they were sent / or in reply to what other packets. They can also have bots watching for all new content as its posted and who downloads files of the same size, etc. I would assume HTTPS will not stop someone from knowing what files you are downloading from a nation-state adversary.
- jackweirdy 12y agoI’d guess exact file size is mostly unique in movies/large files. A good heuristic at least.