Live data from Hacker News

Netflix now supports TLS 1.3

netflixtechblog.com

31–40 of 141 posts

Re: Netflix now supports TLS 1.3

#31
post #24

Earlier quoted context omitted.

>I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. Because secure should be the default where we can do it. If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Either because…

> If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Unless Netflix has also started padding their compressed video segments to a deterministic size, TLS doesn't really help with the "I don't want people to know what video I'm watching" problem, as the encrypted media segments are first compressed using a variable bitrate encoding that causes a unique pa…

well your first attack is only theoretically possible. but it's basically impossible in a big network.

for a single user it's possible. for a network with gigabytes of data, it's basically impossible. it's not just a "tcpdump" and compare against fingerprint.

btw. it's also outdated.

Re: Netflix now supports TLS 1.3

#32
post #15

Earlier quoted context omitted.

from the summary: > From the field test, we are confident that TLS 1.3 provides us a better streaming experience. so they actually measured an improvement in performance metrics.

That's a performance comparison against TLS 1.2. It doesn't speak to why they're concerned about authentication+confidentiality+integrity for audio-video streams in the first place.

Are you hinting at something here, some threat maybe, that you think Netflix is responding to?

Or do you just not think that more security is a good thing generally and should be done for its own sake?

Re: Netflix now supports TLS 1.3

#34
post #24

Earlier quoted context omitted.

>I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. Because secure should be the default where we can do it. If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Either because…

> If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Unless Netflix has also started padding their compressed video segments to a deterministic size, TLS doesn't really help with the "I don't want people to know what video I'm watching" problem, as the encrypted media segments are first compressed using a variable bitrate encoding that causes a unique pa…

VOIP compression of speech too, at least in the past: http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf

edit - said Skype initially but not sure it was specifically skype

Re: Netflix now supports TLS 1.3

#35
post #24

Earlier quoted context omitted.

>I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. Because secure should be the default where we can do it. If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Either because…

> If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Unless Netflix has also started padding their compressed video segments to a deterministic size, TLS doesn't really help with the "I don't want people to know what video I'm watching" problem, as the encrypted media segments are first compressed using a variable bitrate encoding that causes a unique pa…

Yup. One thing that I'm surprised to see hasn't happened already, but maybe has a better chance in QUIC than TLS 1.3 itself is making use of TLS 1.3 padding to exactly fill the MTU on typical 1500 byte (or so) links.

The TLS 1.3 on-wire format is weird because it needs to pass rusted-in-place TLS 1.2 only middleboxes. One of the convenient side effects is that you can add one or more bytes of padding "free". Any 1499 byte packet can be transformed into a 1500 byte packet just by adding one byte of padding whereas many naive formats couldn't do that.

So this means you could "right size" packets just before sending, so that you still send the same number of packets but they're always full, reducing the ability to distinguish their contents by length.

Signal does something more sophisticated to defeat this sort of analysis for its GIF support. The local client does two or more overlapping GETs. So maybe it needs a 14230 byte GIF but it fetches 8430 and 9401 bytes of data then throws some of it away to re-assemble the 14230 bytes needed, an adversary is left with too many possibilities. But it's probably a bit much to expect Netflix subscribers to pay extra for bandwidth just to defeat an adversary who wants to know how much of Tiger King they've seen.

Re: Netflix now supports TLS 1.3

#36
post #24

Earlier quoted context omitted.

> If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Unless Netflix has also started padding their compressed video segments to a deterministic size, TLS doesn't really help with the "I don't want people to know what video I'm watching" problem, as the encrypted media segments are first compressed using a variable bitrate encoding that causes a unique pa…

That's really interesting, if i'm understanding this correctly it's basically another form of compression leaking information about the underlying data. Would they need to pad everything to a deterministic size or would they just need to change some early parameters during the encoding process to throw off the rest of the chain? But in the end it still doesn't mean TLS isn't worth it for all the other benefits (not t…

The way static "streaming" video works is that you divide the video into a number of small segments--maybe every 10 seconds or every 2 seconds or something--and then encode each of those segments at various quality levels and store all of those files on HTTP servers. There is then a "manifest" file that lets the client learn what qualities are available and what their URLs will be for various timestamps. The client then just starts downloading chunks. If it is finding itself with free time, it starts downloading higher quality (larger) chunks in the future. If it isn't downloading them fast enough, it downloads lower quality (smaller) chunks in the future.

The issue then is that no matter what you do with the compression algorithms, the user is downloading these chunks and you can see the pattern of packets in one direction setting up requests and the packets in the other direction replying with the chunks and you can fingerprint what movie someone is watching. It isn't some kind of encoding issue, as the data is all encrypted: it is the entire concept of taking fixed length segments of a movie that will compress to some non-determinstic size. If you take the first two minutes of every Star Wars movie, divide each up into 10 second segments, and then compress those segments, the sequence of sizes of the segments will be pretty unique.

What is so great about this particular paper is that you don't even really need to analyze the TLS layer and try to pay close attention to really figure out the request/responses: they just fingerprint the TCP flow and that's sufficient, which in retrospect doesn't surprise me as what you are really looking for is some kind of rate of requests to responses for the chunks over the course of those first few minutes of watching the video, and don't really need to know for sure where the boundaries are: you have a long enough sequence and a small enough catalog (there aren't tens of millions or billions of videos on Netflix) to get a really strong fingerprint using just the relative rates.

To fix this you really need to either inject extra random traffic (such as extra packets to the server that break up the request rates) that adds so much noise that you can't figure out the signal "in time"--if it takes longer to fingerprint a movie than the length of a typical movie, that's "good enough"--or you need to destroy signal (which is a better description of what we do if the video segments are all the same size: at that point all movies are by definition the same sequence over and over again; if you then pad the length of every movie to the same 4 hour runtime and force the user to download all of the padded black video frames, you essentially 100% solve the problem ;P).

Re: Netflix now supports TLS 1.3

#37
post #31
post #24

Earlier quoted context omitted.

> If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Unless Netflix has also started padding their compressed video segments to a deterministic size, TLS doesn't really help with the "I don't want people to know what video I'm watching" problem, as the encrypted media segments are first compressed using a variable bitrate encoding that causes a unique pa…

well your first attack is only theoretically possible. but it's basically impossible in a big network. for a single user it's possible. for a network with gigabytes of data, it's basically impossible. it's not just a "tcpdump" and compare against fingerprint. btw. it's also outdated.

Why would the size of the network possibly matter?... You do know that you can just filter the packets by IP address, right? ;P

Re: Netflix now supports TLS 1.3

#38

Earlier quoted context omitted.

ISPs can still datamine which shows each user is watching simply based on the bursts of data as shows have fast moving or slow moving scenes. There are only a few tens of thousands of shows on Netflix, so it ought to be easy to identify.

Has anyone demonstrated that this attack is actually practical? It's super interesting. One way to defeat it, that is already happening to some extent (though not for this reason), is buffering. Maintain a large enough local buffer, and fill it at a constant bitrate, rather than runrate, and you lose this attack vector, no?

The attack is known from VoIP systems: https://www.researchgate.net/publication/321888273_Classific...

Adapting the research to other non-CBR streams doesn't sound far-fetched.

Re: Netflix now supports TLS 1.3

#39
post #34
post #24

Earlier quoted context omitted.

> If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Unless Netflix has also started padding their compressed video segments to a deterministic size, TLS doesn't really help with the "I don't want people to know what video I'm watching" problem, as the encrypted media segments are first compressed using a variable bitrate encoding that causes a unique pa…

VOIP compression of speech too, at least in the past: http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf edit - said Skype initially but not sure it was specifically skype

You can defeat this for VoIP by using a codec in CBR (Constant Bitrate) mode. You should look for this feature in secure audio software.

Unfortunately for video CBR is generally thought to be too expensive to be acceptable. 50kbps CBR Opus wastes 22Mbytes of data in an hour if you're silent compared to a good VBR codec. A small price to pay for improved security. But a CBR Netflix encoding might move several gigabytes per hour of extra data compared to a visually similar VBR encoding, and that's going to really hurt both Netflix and quota restricted customers.

Re: Netflix now supports TLS 1.3

#40

Earlier quoted context omitted.

Also to prevent traffic shaping: ISPs throttle traffic that contains netflix.com in the SNI. ESNI (encrypted SNI) comes with TLS 1.3.

Networking noob here. Can‘t the ISP see Netflix‘s ASN/commonly used IP‘s and shape that way?

IIRC netflix mostly use AWS these days. So checking IPs will just check for anything AWS hosted.
Post reply on HN