Exploring the Capabilities and Limitations of Video Stream Fingerprinting

While streaming video has become a dominant form of information on the web, a number of previous works have shown that encrypted streaming video is vulnerable to network traffic fingerprinting. This attack allows a passive, network-level adversary to learn patterns in sequences of encrypted packet sizes, directions, and timing to infer which videos a user has watched or is watching. However, there are unanswered questions about the capabilities and limitations of video stream fingerprinting. We present a novel dataset and use it to answer two such questions. We explore how well the existing approach can perform in open-world scenarios at a more realistic scale, and we explore the degree of protection that Tor provides against it. We find that an adversary with a modest recall goal of around 0.5 could be effective at the scale of small video hosting platforms with this approach, but not at the scale of the largest and most popular platforms. We also find that Tor does provide protection, but the protection is much more marginal than the literature has previously suggested. Finally, we propose future work using our dataset to address more unanswered questions.