Anybody monitoring their traffic who is also capable of breaking TLS.

Traffic flow analysis would probably work quite well on reddit. They could confirm/deny with high confidence whether certain subreddits/posts are accessed without any need to decrypt, just by how big the responses are.

I was initially sceptical that traffic analysis would be enough, but it appears that mainstream TLS does indeed leak a lot of metadata, especially with the typical structure of splitting resources across distinct servers (eg: static.example.com for images). I wonder if the security of something the size of Reddit might not be improved by simply having a large fleet of dns round-robin app servers that all deliver all content from one domain.

I found:

"Identifying Website Users by TLS Traffic Analysis: New Attacks and Effective Countermeasures"

https://hal.inria.fr/hal-00732449/

Does anyone know of other, recent research in this area? It's been a long time since I last looked at opaque data captures of TLS/SSL traffic.

I also found: https://tools.ietf.org/html/draft-ietf-tls-chacha20-poly1305... which states in part:

"It should be noted that AEADs, such as ChaCha20-Poly1305, are not intended to hide the lengths of plaintexts. When this document speaks of side-channel attacks, it is not considering traffic analysis, but rather timing and cache side-channels. Traffic analysis, while a valid concern, is outside the scope of the AEAD and is being addressed elsewhere in future versions of TLS."

On a skim of https://tools.ietf.org/html/draft-ietf-tls-tls13-11 I couldn't find anything new wrt. recommendations on padding with the goal of thwarting traffic analysis?

Anyone have any pointers on this?

Since all the posts on Reddit are timestamped, someone sniffing traffic could probably do a decent job tying HTTPS requests (and the IP addresses they came from) to new posts that show up, and the users who posted them.

Or somebody who has access to their servers, which are AWS.

I would be shocked if NSA didn't get a secret court order to get AWS access.

Who needs to break encryption when you can break 99% of deployed OS kernels across all platforms?

So, the NSA.