Re: [Pearg] Website fingerprinting with QUIC

[Siby Sandra Deepthy <[e-mail]>]

Hi Christian,


Some of my colleagues and I are currently working on this problem. If there are others working/interested in this area, we'd be happy to chat!


Regards,

Sandra

________________________________
From: Pearg <[e-mail]> on behalf of Christian Huitema <[e-mail]>
Sent: Thursday, February 4, 2021 9:51:59 PM
To: [e-mail]
Subject: [Pearg] Website fingerprinting with QUIC

I just saw this paper: Website Fingerprinting on Early QUIC Traffic, https://arxiv.org/abs/2101.11871<https://urldefense.com/v3/__https:/arxiv.org/abs/2101.11871__;!!Emaut56SYw!kXz4ZIkt-vgb-C_c-7Zccfeyn0EVJivN7iQUAvXg6BorOv_W2qbbDVXLDsB0DoW-tw$>.
The authors describe how they trains models to recognize web sites from observations of traffic pattern, using features like packet observed in both directions of traffic and classification of packets as short/medium/full length. They claim that such fingerprinting is easier when the transport is using QUIC than when it is using HTTPS. There are some limitations in this paper. They test against an early version of Google QUIC, not the latest IETF version. They use only the Chrome client, thus have to consider just one rendering sequence. They force the clients to clear their caches and thus download the full sites, which makes identification easier. And they use somewhat charged language, like "the insecurity characteristic of QUIC", when they merely demonstrated vulnerability to traffic fingerprinting. But then, yes, the results are interesting.
When I see papers like that, I am always of two minds. On one hand, I know that some features of the QUIC transport like PING or PAD frames make it easy to pad packet sizes and to inject traffic that does not interfere with the application, and that proper use of such padding and injection might disturb the finger printing models used by censors. On the other hand, I am aware of the tit-for-tat competition that will ensue, with better obfuscation driving development of more efficient finger printing models. Still, I wonder whether someone is working on that today: train fingerprinting models using techniques similar to those in the paper, and then compare how different models of padding and packet injection disturb this fingerprinting.
-- Christian Huitema