3 ms·
If the DRM key is transferred securely, how can an attacker tell what you're watching without fingerprinting the entire Netflix library? You can't just open up
by Lx1oG-AWb6h_ZG0 12y ago
If the DRM key is transferred securely, how can an attacker tell what you're watching without fingerprinting the entire Netflix library? You can't just open up parts of the stream and parse it as a plain video file to my understanding.
I'll give you the rewind scenario, but play/pause events are going to be equally obvious in HTTPS. Besides, what exactly does the attacker learn? That you were watching Netflix during that time? The HTTPS traffic to Netflix will be an equally good indicator of that.
- comex 12y agoFingerprinting the entire Netflix library - especially if you limit yourself to popular shows - probably isn't that hard. I concur with not really understanding the point, though. One possibly relevant factor is that shared encryption keys make it harder to authenticate the data: you can't rely on an HMAC, and RSA verifying every frame would be too slow. You can still do it efficiently with a hash tree, but I bet Netflix currently isn't, and TLS allows browsers to enforce verification on behalf of the user. Without verification, you could potentially exploit the browser with malformed audio or video data, or freak the user out by injecting some other video...
- dheera 12y agoI imagine a side-channel attack could reveal some of this information. Fingerprint bandwidth usage over time. Movies consume less bandwidth when scenes move slowly and HTTPS doesn't do a good job of hiding this information.