Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netflix now supports TLS 1.3

netflixtechblog.com

Post reply on HN
Print view View original

41–50 of 141 posts

Re: Netflix now supports TLS 1.3

#41

Post by merb »

saurik wrote: post #37
merb wrote: post #31

Earlier quoted context omitted.

well your first attack is only theoretically possible. but it's basically impossible in a big network. for a single user it's possible. for a network with gigabytes of data, it's basically impossible. it's not just a "tcpdump" and compare against fingerprint. btw. it's also outdated.

Why would the size of the network possibly matter?... You do know that you can just filter the packets by IP address, right? ;P

yeah with a targeted attack. but I've meant big scale monitoring which person watches what.

also eme basically solves this on the audo and video side. (maybe not the best solution tough)

Re: Netflix now supports TLS 1.3

#42

Post by mimsee »

jiggawatts wrote: post #33

[flagged]

How's it not 4K?

You need to use Windows 10 Creator update or newer and the Edge browser (most likely the old one and not the newer Chromium based). You need an Intel 7th generation CPU (i3, i5, or i7) or an Nvidia GPU.[1][2]

[1]: https://help.netflix.com/en/node/23931

[2]: https://nvidia.custhelp.com/app/answers/detail/a_id/4583/~/4...

Re: Netflix now supports TLS 1.3

#43

Post by Spooky23 »

MaxBarraclough wrote: post #5

I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.

ISPs compete with them. They need to think of Comcast wanting to degrade the experience of watching a show that is also available on Peacock.

Re: Netflix now supports TLS 1.3

#45

Post by profmonocle »

daurnimator wrote: post #40
v7p1Qbt1im wrote: post #9

Earlier quoted context omitted.

Networking noob here. Can‘t the ISP see Netflix‘s ASN/commonly used IP‘s and shape that way?

IIRC netflix mostly use AWS these days. So checking IPs will just check for anything AWS hosted.

For the web site and UI, yes. But the actual video traffic comes from a private CDN: https://openconnect.netflix.com

Re: Netflix now supports TLS 1.3

#46

Post by Tomdarkness »

mimsee wrote: post #42
jiggawatts wrote: post #33

[flagged]

How's it not 4K? You need to use Windows 10 Creator update or newer and the Edge browser (most likely the old one and not the newer Chromium based). You need an Intel 7th generation CPU (i3, i5, or i7) or an Nvidia GPU.[1][2] [1]: https://help.netflix.com/en/node/23931 [2]: https://nvidia.custhelp.com/app/answers/detail/a_id/4583/~/4...

Despite having all of those requirements I still can't get 4k streams on my PC. All I've managed to find are rumours from unofficial sources that there's some issue with HDCP 2.2 when using displayport with certain monitors. Either way it's extremely convoluted. In fact it's vastly easier just to pirate the 4k version. I don't feel bad about doing this because I already pay for netflix.

Re: Netflix now supports TLS 1.3

#47

Post by michaelt »

mimsee wrote: post #42
jiggawatts wrote: post #33

[flagged]

How's it not 4K? You need to use Windows 10 Creator update or newer and the Edge browser (most likely the old one and not the newer Chromium based). You need an Intel 7th generation CPU (i3, i5, or i7) or an Nvidia GPU.[1][2] [1]: https://help.netflix.com/en/node/23931 [2]: https://nvidia.custhelp.com/app/answers/detail/a_id/4583/~/4...

> How's it not 4K?

Many people report Netflix's 4k is very heavily compressed compared to 4k blu-ray, making it high quality in name only.

I wouldn't know, because Netflix won't serve 4k content to any of my devices.

Re: Netflix now supports TLS 1.3

#48

Post by smileybarry »

mimsee wrote: post #42
jiggawatts wrote: post #33

[flagged]

How's it not 4K? You need to use Windows 10 Creator update or newer and the Edge browser (most likely the old one and not the newer Chromium based). You need an Intel 7th generation CPU (i3, i5, or i7) or an Nvidia GPU.[1][2] [1]: https://help.netflix.com/en/node/23931 [2]: https://nvidia.custhelp.com/app/answers/detail/a_id/4583/~/4...

> the Edge browser (most likely the old one and not the newer Chromium based).

Chromium-Edge also supports 4k (and higher-bitrate 1080p) streaming because Microsoft added the same DRM used in normal Edge to Chromium-Edge.

Re: Netflix now supports TLS 1.3

#49

Post by MaxBarraclough »

CydeWeys wrote: post #32
MaxBarraclough wrote: post #16

Earlier quoted context omitted.

That's a performance comparison against TLS 1.2. It doesn't speak to why they're concerned about authentication+confidentiality+integrity for audio-video streams in the first place.

Are you hinting at something here, some threat maybe, that you think Netflix is responding to? Or do you just not think that more security is a good thing generally and should be done for its own sake?

It's possible to distribute large binary blobs over unencrypted HTTP, and to provide security using hash checks. I believe apt no longer does this due to a flaw in their implementation that would not have been an issue if they'd used HTTPS. I'm unsure if Steam still uses insecure HTTP, but they certainly used to. [0] [1]

I'm all for HTTPS everywhere, but for Netflix and YouTube, that means encrypting exabytes of data. That's going to cost them quite a bit. Seems reasonable to go for more detail than It's good practice in general.

> Are you hinting at something here

No, as I put in my first comment, I think we know the specific reasons (untrustworthy ISPs), it's just interesting they didn't mention them.

[0] https://whydoesaptnotusehttps.com/

[1] https://developer.valvesoftware.com/wiki/SteamPipe#Server_ad...

Re: Netflix now supports TLS 1.3

#50

Post by MaxBarraclough »

merb wrote: post #41
saurik wrote: post #37

Earlier quoted context omitted.

Why would the size of the network possibly matter?... You do know that you can just filter the packets by IP address, right? ;P

yeah with a targeted attack. but I've meant big scale monitoring which person watches what. also eme basically solves this on the audo and video side. (maybe not the best solution tough)

How does EME change anything?
Post reply on HN