51–60 of 141 posts
[flagged]
I was under the impression you actually can via exactly one browser: Microsoft Edge.
Earlier quoted context omitted.
from the summary: > From the field test, we are confident that TLS 1.3 provides us a better streaming experience. so they actually measured an improvement in performance metrics.
That's a performance comparison against TLS 1.2. It doesn't speak to why they're concerned about authentication+confidentiality+integrity for audio-video streams in the first place.
Earlier quoted context omitted.
CloudFlare has ESNI enabled (and so do websites hosted by it, like medium.com) so it's not as if no one is doing it.
If no clients support it, and you can't tell as a user if it is working, then effectively no one is using it.
Earlier quoted context omitted.
CloudFlare has ESNI enabled (and so do websites hosted by it, like medium.com) so it's not as if no one is doing it.
If no clients support it, and you can't tell as a user if it is working, then effectively no one is using it.
Users can test their ESNI support online here: https://www.cloudflare.com/ssl/encrypted-sni/
Earlier quoted context omitted.
That's really interesting, if i'm understanding this correctly it's basically another form of compression leaking information about the underlying data. Would they need to pad everything to a deterministic size or would they just need to change some early parameters during the encoding process to throw off the rest of the chain? But in the end it still doesn't mean TLS isn't worth it for all the other benefits (not t…
The way static "streaming" video works is that you divide the video into a number of small segments--maybe every 10 seconds or every 2 seconds or something--and then encode each of those segments at various quality levels and store all of those files on HTTP servers. There is then a "manifest" file that lets the client learn what qualities are available and what their URLs will be for various timestamps. The client t…
Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load?
& HTTP is not an option. I for one enjoy my ISP not being able to inject ads into my streams
I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.
1. Integrity is redundant with authentication, so really you could say they're ensuring confidentiality + authentication. You can't authenticate a thing without implicitly obtaining assurance of integrity. It's a strictly stronger property.
2. Confidentiality is (usually) insecure and unreliable without authentication. Without authentication you have no PKI for a key exchange to symmetric encryption, so you can't even do TLS in the first place. And if you don't have a carefully applied MAC or a native AEAD mode, your symmetric mode isn't that secure either.
So really what you're asking reduces to the question of why they need the most sophisticated TLS scheme for encrypting their streams. If they want the most secure TLS scheme for confidentiality, TLS 1.3 is the way to do it. They explained one particular facet of why this is the case, re: perfect forward secrecy.
Earlier quoted context omitted.
The way static "streaming" video works is that you divide the video into a number of small segments--maybe every 10 seconds or every 2 seconds or something--and then encode each of those segments at various quality levels and store all of those files on HTTP servers. There is then a "manifest" file that lets the client learn what qualities are available and what their URLs will be for various timestamps. The client t…
Doesn't this inspection of the manifest have a fairly limited scope in how it can be exploited though? I know the attacker will be able to see what someone is watching, but only for non-novel information, right? You can't use that technique to guess anything new, and had to have yourself already seen the video?
That said, as noted by someone else on this thread, there has been some work done figuring out what people are saying by analyzing encrypted speech packets; but I imagine that kind of technique would be almost impossible to pull off with these segments on the order of multiple seconds long, and including the video in the stream would seem to make that a total non-starter.
Can someone explain why this thread is full of people not caring about security? This article even goes over how TLS 1.3 is a perf improvement Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load? & HTTP is not an option. I for one enjoy my ISP not being able to inject ads…
Netflix already had a secure system with their original business model of mailing you the content.
Finally, allowing advertisers to profile us based on our browsing data is one step before allowing the police to do so as well. Maybe it's the same step.
Can someone explain why this thread is full of people not caring about security? This article even goes over how TLS 1.3 is a perf improvement Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load? & HTTP is not an option. I for one enjoy my ISP not being able to inject ads…
We don't allow our mail to be seized and read without warrant, why should our other data be susceptible? Netflix already had a secure system with their original business model of mailing you the content. Finally, allowing advertisers to profile us based on our browsing data is one step before allowing the police to do so as well. Maybe it's the same step.