Hacker News Reader

Comment by tyingq | Hacker News Reader

"allowing adversaries to infer the users' visited websites by eavesdropping on the transmission channel."

Ah, ok, that kind of fingerprinting. I suppose then this might be where our local ISP's find a way to replace their now threatened DNS query sniffing. Assuming 95.4% accuracy means what I think it does, that's pretty impressive.

View on HN

Hah. I accidentally read "advertisers" instead of "adversaries". Still valid I guess...?

That’s exactly how I read it as well!

In the same way that we use "i18n" to abbreviate "internationalization", I propose we start using "adver5s" for both of these. :P

They might as well be synonyms at this point.

I skimmed the paper and read it as an improved passive attack against ESNI and Do{T,H} setups. There's nothing really new, other than QUIC making it easier to identify the destinations.

Traffic analysis is a harsh villain.

Sadly, eSNI is dead in the water, but an alternative is being worked on. It'll just take longer for it to come to market.

When you say ESNI is dead in the water, do you mean that it’s moved on to being ECH (encrypted client hello)? Or do you mean the entire concept is dead? If the latter, what makes you say that?

I meant the conversion to ECH. eSNI has had proof-of-concept support built in for a while and, had it worked out better, could have been deployed publicly any day now. The new extension, ECH, will need significant testing and development until it can reach the same level of support again.

The concept is the clear and obvious way forward in web security; what's the point in encrypting DNS when the SNI is still readable. I'm also glad that eSNI has been dropped because of the obvious flaws found in it rather than continuing attempts to secure an inherently flawed protocol. However, this does mean that deployment will take longer than previously estimated, which is kind of a bummer.

I bet you could get 95.4% accuracy by simply looking at the IP addresses that users connect to.

Each webpage comes from an IP, but includes subresources from a whole set of domains. I would guess that for the vast majority of web sites, that set of domains is unique.

I'm guessing not, as they say "whereas only 60.7% when on HTTPS".

Here is a presentation and blog post where they did a study about this:

"What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf

https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an...

> The majority of websites (95.7%) have a unique PLF, suggesting there is a risk of identifying that a user is visiting the site solely from a list of contacted IP addresses

So, yes, IP addresses are plenty sufficient to figure out what someone is browsing.

Reply on news.ycombinator.com