4 ms·

Without encrypting the video contents, anyone sniffing the data stream can easily tell what you're watching, when you paused, or skipped, or re-played, etc. The

Without encrypting the video contents, anyone sniffing the data stream can easily tell what you're watching, when you paused, or skipped, or re-played, etc. They may not be able to steal your money with that data, but it still exposes real, personal information. (though... I was just thinking about this, and due to the use of variable-bitrate encoding, the varied rate of data transmission over time (even though encrypted) would give each video a fingerprint that an observer could use to determine whatever it is that you're watching, anyway, albeit with greater effort that simply inspecting the unencrypted stream)

phkahler 12y ago
>> I was just thinking about this, and due to the use of variable-bitrate encoding As I recall, monitoring total home power consumption could also identify what you're watching on TV. That was on the old CRT sets, not sure about now. Gotta love side channel attacks.
- wmf 12y ago
  Some HDTVs have dynamic LED backlighting that is probably a power side channel.
  - jjp 12y ago
    http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/07/24/ike2012.pdf http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/07/...
    - thrownaway2424 12y ago
      This is why I only drink rainwater and grain alcohol, and use pure class A amplifiers, Mandrake.
      - jjp 12y ago
        And you know that can be tracked as well - http://www.academia.edu/5585470/Hydrological_Studies_Using_Isotopes http://www.academia.edu/5585470/Hydrological_Studies_Using_I...
Lx1oG-AWb6h_ZG0 12y ago
If the DRM key is transferred securely, how can an attacker tell what you're watching without fingerprinting the entire Netflix library? You can't just open up parts of the stream and parse it as a plain video file to my understanding. I'll give you the rewind scenario, but play/pause events are going to be equally obvious in HTTPS. Besides, what exactly does the attacker learn? That you were watching Netflix during that time? The HTTPS traffic to Netflix will be an equally good indicator of that.
- comex 12y ago
  Fingerprinting the entire Netflix library - especially if you limit yourself to popular shows - probably isn't that hard. I concur with not really understanding the point, though. One possibly relevant factor is that shared encryption keys make it harder to authenticate the data: you can't rely on an HMAC, and RSA verifying every frame would be too slow. You can still do it efficiently with a hash tree, but I bet Netflix currently isn't, and TLS allows browsers to enforce verification on behalf of the user. Without verification, you could potentially exploit the browser with malformed audio or video data, or freak the user out by injecting some other video...
- dheera 12y ago
  I imagine a side-channel attack could reveal some of this information. Fingerprint bandwidth usage over time. Movies consume less bandwidth when scenes move slowly and HTTPS doesn't do a good job of hiding this information.

phkahler 12y ago

>> I was just thinking about this, and due to the use of variable-bitrate encoding As I recall, monitoring total home power consumption could also identify what you're watching on TV. That was on the old CRT sets, not sure about now. Gotta love side channel attacks.

wmf 12y ago
Some HDTVs have dynamic LED backlighting that is probably a power side channel.
- jjp 12y ago
  http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/07/24/ike2012.pdf http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/07/...
  - thrownaway2424 12y ago
    This is why I only drink rainwater and grain alcohol, and use pure class A amplifiers, Mandrake.
    - jjp 12y ago
      And you know that can be tracked as well - http://www.academia.edu/5585470/Hydrological_Studies_Using_Isotopes http://www.academia.edu/5585470/Hydrological_Studies_Using_I...

Lx1oG-AWb6h_ZG0 12y ago

If the DRM key is transferred securely, how can an attacker tell what you're watching without fingerprinting the entire Netflix library? You can't just open up parts of the stream and parse it as a plain video file to my understanding. I'll give you the rewind scenario, but play/pause events are going to be equally obvious in HTTPS. Besides, what exactly does the attacker learn? That you were watching Netflix during that time? The HTTPS traffic to Netflix will be an equally good indicator of that.

comex 12y ago
Fingerprinting the entire Netflix library - especially if you limit yourself to popular shows - probably isn't that hard. I concur with not really understanding the point, though. One possibly relevant factor is that shared encryption keys make it harder to authenticate the data: you can't rely on an HMAC, and RSA verifying every frame would be too slow. You can still do it efficiently with a hash tree, but I bet Netflix currently isn't, and TLS allows browsers to enforce verification on behalf of the user. Without verification, you could potentially exploit the browser with malformed audio or video data, or freak the user out by injecting some other video...
dheera 12y ago
I imagine a side-channel attack could reveal some of this information. Fingerprint bandwidth usage over time. Movies consume less bandwidth when scenes move slowly and HTTPS doesn't do a good job of hiding this information.