HackerPapers

arXiv:1403.0297cs.CR

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis

Brad Miller, Ling Huang, A. D. Joseph, J. D. Tygar

Abstract

Revelations of large scale electronic surveillance and data mining by governments and corporations have fueled increased adoption of HTTPS. We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 89% accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. We examine evaluation methodology and reveal accuracy variations as large as 18% caused by assumptions affecting caching and cookies. We present a novel defense reducing attack accuracy to 27% with a 9% traffic increase, and demonstrate significantly increased effectiveness of prior defenses in our evaluation context, inclusive of enabled caching, user-specific cookies and pages within the same website.

arXiv comments
Journal reference
DOI
Subjects
cs.CRCryptography and Security

On Hacker News

Linked by 4 identifiable commenters in 5 comments across 4 threads, from Sep 2014 to Oct 2019. Found in 2 HN submissions from Mar 2014 to Jul 2014. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments4 threads

  1. NordVPN confirms it was hacked 1 comment

    • By looking at side-channel data it was possible to correlate the page being viewed on SSL, IIRC researchers could calculate the page viewed about 70% of the time. I misremembered, it was about 90% -- https://scirate.com/arxiv/1403.0297.

      pbhjpbhjView on HNParent context

  2. VPN – Very Precarious Narrative 1 comment

    • https://scirate.com/arxiv/1403.0297 >We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies…

      pbhjpbhjView on HNParent context

  3. What ISPs can see 1 comment

    • It's possible to decrypt the exact URL you're browsing for a large majority of websites with very high probability, even with forward secrecy. There is an undergraduate project that does this for wikipedia pages (it's easy because of all the unique resources loaded for each…

      traffView on HNParent context

  4. Keyless SSL: The Nitty Gritty Technical Details 2 comments

    • I understand that there are many different types of DDOS attacks, and that for some of them having access to the content on the application level makes your job of mitigating them a lot easier. But even without that, would comparing the encrypted traffic patterns for an…

      vader1View on HNParent context

    • > You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption. > Yet to do so would be to defeat SSL itself, or at least to declare it as insufficient to adequately protect secrets. This is possible…

      handsomeransomsView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.