Netflix now supports TLS 1.3
netflixtechblog.com
Netflix now supports TLS 1.3
1–10 of 141 posts
Re: Netflix now supports TLS 1.3
#2It’s interesting to see daily variation in play delay; is this just related to less network congestion during certain hours?
Re: Netflix now supports TLS 1.3
#3It’s interesting to see daily variation in play delay; is this just related to less network congestion during certain hours?
You have different audience mix around the world (and even within each country) at different times of the day. At certain hours it's more mobile, other hours it's more desktop; more US or more Asia etc. (unclear what data is shown on the graph though)
Re: Netflix now supports TLS 1.3
#4It’s interesting to see daily variation in play delay; is this just related to less network congestion during certain hours?
Yes specifically queuing delay. It is unlikely that any significant proportion of packets are being retried but both servers and network infrastructure will have slightly longer queues.
Re: Netflix now supports TLS 1.3
#5I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details.
As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.
Re: Netflix now supports TLS 1.3
#6I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.
Also to prevent traffic shaping: ISPs throttle traffic that contains netflix.com in the SNI. ESNI (encrypted SNI) comes with TLS 1.3.
Re: Netflix now supports TLS 1.3
#7I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.
Also to prevent traffic shaping: ISPs throttle traffic that contains netflix.com in the SNI. ESNI (encrypted SNI) comes with TLS 1.3.
Ah, the good ol' radar detector reflector.
There was a skit I saw a couple decades ago where a person was showing off his radar detector, then in order to combat that, the police had developed a radar detector reflector, so then he had made a radar detector reflector protector or something like that, then they made a protector detector, and so on. It was a couple minutes of explaining his best efforts to counter the police counters to his counters and on and on. But, you know, funny.
Re: Netflix now supports TLS 1.3
#8I wonder if this is also done in-kernel on their edge machines. I know that they used to do it in kernel with ktls(?) on FreeBSD which they themselves are a developer of.
Re: Netflix now supports TLS 1.3
#9I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.
Also to prevent traffic shaping: ISPs throttle traffic that contains netflix.com in the SNI. ESNI (encrypted SNI) comes with TLS 1.3.
Networking noob here. Can‘t the ISP see Netflix‘s ASN/commonly used IP‘s and shape that way?
Re: Netflix now supports TLS 1.3
#10I noticed they didn't explicitly mention why they feel the need to ensure authentication+confidentiality+integrity for their streams, given that the data they're dealing with is films and TV shows, rather than, say, payment details. As I understand it, they use HTTPS to prevent spying and data-mining by unscrupulous ISPs. It doesn't affect their DRM at all, which would work just as well over plain HTTP.
Also to prevent traffic shaping: ISPs throttle traffic that contains netflix.com in the SNI. ESNI (encrypted SNI) comes with TLS 1.3.
ESNI was dropped from the TLS1.3 spec. It is currently a draft protocol.
Almost nothing supports ESNI yet. Chrome does not have it yet. Firefox does but it very difficult to enable, there is a config flag but it does nothing on its own unless you also enable DNS over HTTP in Firefox.
OpenSSL has no support for ESNI yet either.
ESNI also never tells the user if it is working or not yet, making downgrades fairly easy.
ESNI is a long way from being deployed, let alone useful.