Hacker News Reader

Comment by dantillberg | Hacker News Reader

Without encrypting the video contents, anyone sniffing the data stream can easily tell what you're watching, when you paused, or skipped, or re-played, etc. They may not be able to steal your money with that data, but it still exposes real, personal information.

(though... I was just thinking about this, and due to the use of variable-bitrate encoding, the varied rate of data transmission over time (even though encrypted) would give each video a fingerprint that an observer could use to determine whatever it is that you're watching, anyway, albeit with greater effort that simply inspecting the unencrypted stream)

View on HN

If the DRM key is transferred securely, how can an attacker tell what you're watching without fingerprinting the entire Netflix library? You can't just open up parts of the stream and parse it as a plain video file to my understanding.

I'll give you the rewind scenario, but play/pause events are going to be equally obvious in HTTPS. Besides, what exactly does the attacker learn? That you were watching Netflix during that time? The HTTPS traffic to Netflix will be an equally good indicator of that.

Fingerprinting the entire Netflix library - especially if you limit yourself to popular shows - probably isn't that hard. I concur with not really understanding the point, though.

One possibly relevant factor is that shared encryption keys make it harder to authenticate the data: you can't rely on an HMAC, and RSA verifying every frame would be too slow. You can still do it efficiently with a hash tree, but I bet Netflix currently isn't, and TLS allows browsers to enforce verification on behalf of the user. Without verification, you could potentially exploit the browser with malformed audio or video data, or freak the user out by injecting some other video...

I imagine a side-channel attack could reveal some of this information. Fingerprint bandwidth usage over time. Movies consume less bandwidth when scenes move slowly and HTTPS doesn't do a good job of hiding this information.

>> I was just thinking about this, and due to the use of variable-bitrate encoding

As I recall, monitoring total home power consumption could also identify what you're watching on TV. That was on the old CRT sets, not sure about now.

Gotta love side channel attacks.

Some HDTVs have dynamic LED backlighting that is probably a power side channel.

http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/07/...

This is why I only drink rainwater and grain alcohol, and use pure class A amplifiers, Mandrake.

And you know that can be tracked as well - http://www.academia.edu/5585470/Hydrological_Studies_Using_I...

Reply on news.ycombinator.com