I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis · HackerPapers discussions

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis — mentioned by pbhjpbhj

Mon, 21 Oct 2019 20:39:04 GMT

By looking at side-channel data it was possible to correlate the page being viewed on SSL, IIRC researchers could calculate the page viewed about 70% of the time. I misremembered, it was about 90% -- https://scirate.com/arxiv/1403.0297.

Paper and discussion history. A mention is not an endorsement.

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis — mentioned by pbhjpbhj

Mon, 08 Apr 2019 13:51:23 GMT

https://scirate.com/arxiv/1403.0297 >We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 89% accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. //

Paper and discussion history. A mention is not an endorsement.

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis — mentioned by traff

Sun, 13 Mar 2016 22:37:20 GMT

It's possible to decrypt the exact URL you're browsing for a large majority of websites with very high probability, even with forward secrecy. There is an undergraduate project that does this for wikipedia pages (it's easy because of all the unique resources loaded for each page). Search for papers on https traffic analysis, for example: http://arxiv.org/abs/1403.0297

Paper and discussion history. A mention is not an endorsement.

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis — mentioned by handsomeransoms

Fri, 19 Sep 2014 16:48:46 GMT

> You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption. > Yet to do so would be to defeat SSL itself, or at least to declare it as insufficient to adequately protect secrets. This is possible through HTTPS traffic analysis, see [0] and [1] for starters. Of course, it's much easier for Cloudflare to do analysis for DDoS protection if they have access to plaintext. Whether this means that SSL is, as you say, "insufficient to adequately protect secrets" is an interesting discussion to have. [0]…

Paper and discussion history. A mention is not an endorsement.

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis — mentioned by vader1

Fri, 19 Sep 2014 11:16:01 GMT

I understand that there are many different types of DDOS attacks, and that for some of them having access to the content on the application level makes your job of mitigating them a lot easier. But even without that, would comparing the encrypted traffic patterns for an individual client to other client's patterns (or to that client's traffic to one of the other 2 million Cloudflare websites); and analyzing the encrypted traffic as in [1] not still give you a wealth of information to use? It might have made for a much more rewarding two years of development: even if such a setup would be…

Paper and discussion history. A mention is not an endorsement.

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis — HN submission

Thu, 03 Jul 2014 08:02:39 GMT

Risks and Realization of HTTPS Traffic Analysis

2 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis — HN submission

Fri, 07 Mar 2014 20:23:47 GMT

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Trac Analysis

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.