Re: [Pearg] Website fingerprinting with QUIC

Hi Sandra,

I would be interested to join the review of literature around this topic.

Thanks,

Regards,
Ali Hussain

On Mon, 22 Feb 2021, 11:20 pm Siby Sandra Deepthy, <sandra.siby@epfl.ch>
wrote:

> Hi Christian,
>
>
> Some of my colleagues and I are currently working on this problem. If
> there are others working/interested in this area, we'd be happy to chat!
>
>
> Regards,
>
> Sandra
> ------------------------------
> *From:* Pearg <pearg-bounces@irtf.org> on behalf of Christian Huitema <
> huitema@huitema.net>
> *Sent:* Thursday, February 4, 2021 9:51:59 PM
> *To:* pearg@irtf.org
> *Subject:* [Pearg] Website fingerprinting with QUIC
>
>
> I just saw this paper: Website Fingerprinting on Early QUIC Traffic,
> https://arxiv.org/abs/2101.11871
> <https://urldefense.com/v3/__https:/arxiv.org/abs/2101.11871__;!!Emaut56SYw!kXz4ZIkt-vgb-C_c-7Zccfeyn0EVJivN7iQUAvXg6BorOv_W2qbbDVXLDsB0DoW-tw$>
> .
>
> The authors describe how they trains models to recognize web sites from
> observations of traffic pattern, using features like packet observed in
> both directions of traffic and classification of packets as
> short/medium/full length. They claim that such fingerprinting is easier
> when the transport is using QUIC than when it is using HTTPS. There are
> some limitations in this paper. They test against an early version of
> Google QUIC, not the latest IETF version. They use only the Chrome client,
> thus have to consider just one rendering sequence. They force the clients
> to clear their caches and thus download the full sites, which makes
> identification easier. And they use somewhat charged language, like "the
> insecurity characteristic of QUIC", when they merely demonstrated
> vulnerability to traffic fingerprinting. But then, yes, the results are
> interesting.
>
> When I see papers like that, I am always of two minds. On one hand, I know
> that some features of the QUIC transport like PING or PAD frames make it
> easy to pad packet sizes and to inject traffic that does not interfere with
> the application, and that proper use of such padding and injection might
> disturb the finger printing models used by censors. On the other hand, I am
> aware of the tit-for-tat competition that will ensue, with better
> obfuscation driving development of more efficient finger printing models.
> Still, I wonder whether someone is working on that today: train
> fingerprinting models using techniques similar to those in the paper, and
> then compare how different models of padding and packet injection disturb
> this fingerprinting.
>
> -- Christian Huitema
>
>
> --
> Pearg mailing list
> Pearg@irtf.org
> https://www.irtf.org/mailman/listinfo/pearg
>